fix(app): stop probing the control plane while disconnected

VpnConnection._init() started a 30 s /health poll from the constructor with no lifecycle gating, so it ran for the life of the app process - backgrounded, and whether or not the user ever connected. The app is excluded from its own tunnel, so those requests left in the clear. A periodic request that fires while the user is deliberately not connected is an avoidable fingerprint, and rule 60 already ruled probes out: reachability is meant to be passive. All it bought was the status dot before the first connect, and it got that wrong in both directions - "Offline" on a transient resolver failure against a server that was fine. Reachability now comes from a session sync that succeeded. serverHealthy is isConnected && hasSyncedOnce, so a green dot means a working session rather than a check made beforehand; while disconnected the bar reads "Ready" and claims nothing either way. checkHealth() goes with it. Nothing calls it, and leaving a probe helper in place invites its reuse. Pinned in test/session_lifecycle_regression_test.dart so it cannot come back as a tidy-up. flutter analyze clean, 10/10 tests pass. Co-Authored-By: Claude Opus 5 <[email protected]>
feat(session): every reconnect starts a fresh session
2026-10-17 21:17:17 +03:00 · 2026-10-17 18:53:42 +03:00 · 2026-10-17 18:22:19 +03:00 · 2026-10-17 17:17:29 +03:00 · 2026-10-17 16:47:29 +03:00 · 2026-10-17 16:46:49 +03:00
94 changed files with 16586 additions and 1089 deletions
@@ -0,0 +1,10 @@
 * text=auto eol=lf
 *.bat text eol=crlf
 *.ps1 text eol=crlf
 *.png binary
 *.jpg binary
 *.jpeg binary
 *.webp binary
 *.jks binary
 *.keystore binary
 *.jar binary
@@ -0,0 +1,135 @@
 name: Android CI
 on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
 permissions:
  contents: read
 jobs:
  android:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Set up Java 17
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
        with:
          distribution: temurin
          java-version: '17'
      - name: Verify Gradle supply chain
        shell: bash
        run: |
          set -euo pipefail
          test -x android/gradlew
          test -f android/gradlew.bat
          test -f android/gradle/wrapper/gradle-wrapper.jar
          test -s android/gradle/verification-metadata.xml
          test "$(sha256sum android/gradle/wrapper/gradle-wrapper.jar | awk '{print $1}')" = '7d3a4ac4de1c32b59bc6a4eb8ecb8e612ccd0cf1ae1e99f66902da64df296172'
          grep -qx 'distributionSha256Sum=efe9a3d147d948d7528a9887fa35abcf24ca1a43ad06439996490f77569b02d1' android/gradle/wrapper/gradle-wrapper.properties
          grep -q '<verify-metadata>true</verify-metadata>' android/gradle/verification-metadata.xml
          ./android/gradlew --version
      - name: Set up Flutter
        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
        with:
          flutter-version: '3.47.2'
          channel: stable
          cache: false
      - name: Create CI app config
        run: cp lib/logic/app_config.example.dart lib/logic/app_config.dart
      - name: Resolve dependencies
        run: flutter pub get
      - name: Verify dependency lock is committed
        run: git diff --exit-code -- pubspec.lock
      - name: Verify vendored runtime provenance
        if: ${{ hashFiles('local_packages/flutter_vless_android-1.1.5/UPSTREAM') != '' }}
        shell: bash
        run: |
          set -euo pipefail
          PKG='local_packages/flutter_vless_android-1.1.5'
          test -f "$PKG/UPSTREAM"
          grep -q 'Tag: v1.1.5' "$PKG/UPSTREAM"
          grep -q 'path: local_packages/flutter_vless_android-1.1.5' pubspec.yaml
          ! grep -q 'patchFlutterVless' android/app/build.gradle.kts
      - name: Analyze
        run: flutter analyze
      - name: Test
        run: flutter test
      - name: Android lint
        working-directory: android
        run: ./gradlew :app:lintDebug --no-daemon
      - name: Verify production release config fails closed
        shell: bash
        working-directory: android
        run: |
          set -euo pipefail
          set +e
          output="$(./gradlew :app:verifyReleaseAppConfig --no-daemon 2>&1)"
          status=$?
          set -e
          printf '%s\n' "$output"
          test "$status" -ne 0
          grep -Fq 'REVOLT_APP_CONFIG_SHA256 is required for production release builds' <<<"$output"
      - name: Cold APK build
        run: flutter build apk --debug
      - name: Verify vendored native source stayed immutable
        run: git diff --exit-code -- local_packages/flutter_vless_android-1.1.5
      - name: Warm APK build
        run: flutter build apk --debug
      - name: Release R8 smoke build
        env:
          REVOLT_CI_RELEASE_SMOKE: 'true'
        run: |
          flutter build apk --release
          test -f build/app/outputs/flutter-apk/app-release.apk
          test -f build/app/outputs/mapping/release/mapping.txt
      - name: Verify tracked build inputs stayed immutable
        run: |
          git diff --exit-code -- \
            pubspec.yaml \
            pubspec.lock \
            local_packages/flutter_vless_android-1.1.5 \
            android/app/build.gradle.kts \
            android/app/proguard-rules.pro \
            android/gradle/verification-metadata.xml \
            android/gradle/wrapper/gradle-wrapper.properties \
            android/gradle/wrapper/gradle-wrapper.jar \
            android/gradlew \
            android/gradlew.bat
      - name: Upload APK
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: revoltvpn-debug-apk
          if-no-files-found: error
          path: build/app/outputs/flutter-apk/app-debug.apk
      - name: Upload resolved lockfile
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: revoltvpn-resolved-lockfile
          if-no-files-found: error
          path: pubspec.lock
@@ -1,23 +1,60 @@
 # =============================================================================
 #  ReVoltVPN — .gitignore
 #
 #  Type-based by design. This repo ships Dart, Kotlin, XML and image assets;
 #  everything else is excluded by extension or directory rather than by being
 #  listed individually. A new file is therefore ignored by default instead of
 #  needing to be named here, and this file does not enumerate what it protects.
 # =============================================================================
-# ── OS & Editor ────────────────────────────────────────────────────────────
+# ── Secrets ────────────────────────────────────────────────────────────────
-*.swp
+*.keystore
-.DS_Store
+*.jks
-.atom/
+android/key.properties
-.history
+android/admob.properties
 .svn/
 .java-version
 .idea/
 .vscode/
-# ── Python ─────────────────────────────────────────────────────────────────
+#  Real IPs and IDs. app_config.example.dart is the committed template.
-__pycache__/
+lib/logic/app_config.dart
 # ── File types the shipped app does not contain ────────────────────────────
 *.py
 *.pyc
 *.json
 *.conf
 *.sh
 *.txt
 *.html
 *.zip
 *.log
 *.class
-# ── Flutter / Dart ─────────────────────────────────────────────────────────
+# ── Documentation ──────────────────────────────────────────────────────────
 #  The published set is allow-listed; anything else, at any depth, is not.
 #  Leading slashes anchor these to the repo root so a same-named file in a
 #  subdirectory is NOT re-included by the negation.
 *.md
 !/README.md
 !/CHANGELOG.md
 !/CONTRIBUTING.md
 !/PRIVACY_POLICY.md
 # ── Working directories ────────────────────────────────────────────────────
 #  Material that is not part of the app. These need directory rules rather
 #  than type rules, because they can hold source-file types the rules above
 #  deliberately do not cover.
 .local/
 internal/
 hivemind/
 scraped/
 backup/
 backups/
 lib/logic/backup/
 server_files/
 # ── Flutter / Dart build output ────────────────────────────────────────────
 .dart_tool/
 *.dart_tool/
 .flutter-plugins
 .flutter-plugins-dependencies
 .pub-cache/
@@ -26,97 +63,35 @@ build/
 **/build/
 local_packages/*/build/
 local_packages/*/.dart_tool/
 *.dart_tool/
 **/doc/api/
 **/ios/Flutter/.last_build_id
-# ── Android ────────────────────────────────────────────────────────────────
+# ── Android build output ───────────────────────────────────────────────────
 **/android/**/gradle-wrapper.jar
 **/android/.gradle
 **/android/.cxx/
 **/android/app/build/
 **/android/captures/
 **/android/gradlew
 **/android/gradlew.bat
 **/android/local.properties
 **/android/**/gradle-wrapper.jar
 **/android/**/GeneratedPluginRegistrant.java
 **/android/app/src/main/java/io/flutter/plugins/GeneratedPluginRegistrant.java
 **/android/.cxx/
 **/android/app/build/
 **/android/app/crashlytics-build.properties
-# ── Secrets & Keystores ───────────────────────────────────────────────────
+# ── Editors, tooling & OS ──────────────────────────────────────────────────
-*.keystore
+.claude/
 *.jks
 android/key.properties
 android/admob.properties
 # App config (contains real IPs/IDs — use example as template)
 lib/logic/app_config.dart
 # ── Hivemind server (deployed separately, not part of the Flutter repo) ───
 hivemind/
 server_hivemind_5_0.py
 swarm_watch.py
 nginx_hivemind_reality.conf
 xray_config_reality.json
 swarm_total.json
 # ── Internal docs (not for public repo) ────────────────────────────────────
 AGENTS.md
 FRONTEND_POLISH_REVIEW.md
 RUNNING.md
 SERVER_DEPLOYMENT.md
 SERVER_NOTES.md
 SERVER_SETUP.md
 REALITY_MIGRATION_PLAN.md
 SECURITY_HARDENING.md
 VLESS_APP_CONTRACT.md
 UI_POSITIONING.md
 # ── Technical debt & security audits ───────────────────────────────────────
 technical_debt_*.md
 technical_debt_*_answer.md
 # ── Backups & reference files ──────────────────────────────────────────────
 backups/
 backup/
 hivemind_backup.py
 server full picture.txt
 server_full_picture_2.txt
 00-FULL-REPORT.md
 XRAY_CONFIG_REFERENCE.md
 # ── Logs & temp ────────────────────────────────────────────────────────────
 *.log
 *.class
 server_picture.sh
 # ── AI assistant ───────────────────────────────────────────────────────────
 .codewhale/
-
+.idea/
-# ── Dev tool config ────────────────────────────────────────────────────────
+.vscode/
 .atom/
 .history
 .svn/
 .java-version
 .DS_Store
 *.swp
 __pycache__/
 devtools_options.yaml
 lib/logic/backup/
 scraped
 scraped.zip
 hivemind.zip
 XRAY_AUDIT.md
 TECHNICAL_DEBT.md
 DOCUMENTATION-ARCHITECTURE-V2.md
 config.json
 RESILIENCE_REVIEW.md
 CONFIG_REVIEW.md
 SERVER_SELECTION.md
 THREAT_MODEL.md
 BUSINESS_MODEL.md
 DPI_FINGERPRINT_ANALYSIS.md
 CODE_FINGERPRINT_AUDIT.md
 CONFERENCE_PREP.md
 CONVERSION_CHECKLIST.md
 HIVEMIND_INTERNALS.md
 #why are you even looking at this file? it's a secret. go away.
-SERVER_ARCHITECTURE.md
+whatsthis
 turbovpn_play.html
 supervpn_play.html
 hetzner*
 DEPLOYMENT_REPORT_FINAL.md
@@ -5,6 +5,422 @@ Versions follow [semver](https://semver.org/): MAJOR.MINOR.PATCH
 ---
 ## [Unreleased]
 ### Removed
 - **The background server check while disconnected.** The app no longer contacts
  the server every 30 seconds while you are not connected to it. Nothing about
  the connected session changes.
 ### Changed
 - **The status bar no longer guesses whether the server is up.** It reads
  "Ready" while disconnected and shows "Online" once a session has synced, so a
  green dot now means a session that is actually working rather than a
  reachability check made beforehand.
 ## [3.3.8] — 2026-10-17
 ### Changed
 - **Reconnecting always starts a fresh session.** In SOCKS5 mode, the
  **Reconnect** button used to re-attach to the session you already had. It now
  ends that session and starts a new one, exactly as the connect button does —
  one way to begin a session instead of two, and you get a full window back
  rather than the remainder of a broken one.
 ### Fixed
 - **SOCKS5 "Reconnect" works again.** In 3.3.7 it ended your session and then
  asked for the session it had just ended, failing with "Session not activated".
 ---
 ## [3.3.7] — 2026-10-17
 > **Known issue — fixed in 3.3.8.** In SOCKS5 mode, the **Reconnect**
 > button in Settings ends your session instead of re-attaching to it, and then
 > fails with "Session not activated". It only appears when a proxy session has
 > been orphaned, and you lose the rest of that session rather than anything
 > worse. Workaround: connect again from the main screen. The "SOCKS5 Reconnect"
 > entry below describes the intended behaviour, which this build does not have.
 ### Added
 - **A warning before a session ends.** The VPN service schedules it off the same
  deadline it already enforces, so it arrives even with the app closed, and a
  support top-up moves it with the deadline. It does not promise an exact number
  of minutes: on a deeply sleeping phone Android can hold it back past the end
  of the session, in which case it is skipped rather than shown late.
 - **A "disconnected — not protected" notification** when a session ends without
  you asking: the 2-hour expiry, the data limit, or the server ending the
  session.
 - **SOCKS5 mode now asks for the notification permission.** It never did,
  because it never raises the VPN consent dialog, so on Android 13+ these
  alerts would have been dropped before they were shown.
 - **The app now shows what went wrong.** Connect errors, the reason a session
  ended, and progress while connecting appear under the status bar instead of
  the button silently going back to idle.
 ### Changed
 - **A control-plane outage no longer tears down a working tunnel.** The app used
  to disconnect itself after about two minutes of failed status polls, putting
  you back on your real IP; it now keeps the tunnel up and shows
  "Can't reach the server — still connected". Expiry is still enforced by the
  VPN service's own deadline, which keeps running regardless.
 ### Fixed
 - **The countdown no longer over-reports after the phone sleeps**, and a clock
  moved backwards can no longer stretch a session.
 - **A session that expired while the phone was asleep is recognised on waking**,
  by wall clock rather than by time the device spent awake.
 - **Disconnecting from Android's VPN settings no longer leaves a countdown in
  the notification shade.** It used to sit there frozen, showing time remaining
  on a tunnel that was already gone.
 - **The VPN recovers after the tunnel core stops.** Recovery never worked:
  every attempt failed on the same internal error, and each one left another
  copy of the core running in the background. It now usually comes back on the
  first retry, without dropping the connection.
 - **Disconnecting with the app's own button now releases your session on the
  server** instead of leaving it open until it expires.
 - **SOCKS5 "Reconnect" re-attaches to the current session** instead of
  requesting a new one — see the known issue above; this does not work in 3.3.7.
 - **A core that fails to start now logs why.** Its output was being discarded,
  so the only trace was an exit code.
 ### Groundwork
 - **Rewarded-ad plumbing.** Ads are switched off in this build, so none of this
  is reachable yet: the ad's verification nonce is now carried through to the
  connect call rather than being minted twice, and the client waits longer
  (~36 s) for Google's callback. Reviewed, not yet exercised end to end.
 ## [3.3.6] — 2026-10-08
 ### Fixed
 - **VPN service notification icon.** The ongoing notification now uses the
  bundled `notification_icon` drawable instead of `notification_status_icon`,
  and the vendored runtime resolves that drawable by name at runtime (falling
  back to the platform icon only if it is missing), so the foreground-service
  notification no longer shows the generic Android info icon.
 - **"Test Local SOCKS" no longer claims an outbound it never tested.** Xray
  answers a SOCKS `CONNECT` before it dials upstream, so trusting the `0x00`
  reply reported success for unroutable addresses and for hostnames that can
  never resolve — meaning the test said OK while the server was down, which is
  exactly when it gets run. It now forces a request/response round trip through
  the tunnel and reports distinctly when the outbound never replies, drops the
  connection, or returns unexpected data.
 ---
 ## [3.3.5] — 2026-09-06
 ### Added
 - **Reproducible release verification.** The release build pins the production
  `app_config.dart` by SHA-256 and fails closed on any mismatch, so a release
  APK cannot silently ship a template or wrong server config.
 ### Changed
 - **Vendored Android runtime.** The pinned `flutter_vless` Android runtime is now
  vendored in-tree instead of being patched in the pub cache at build time.
 - **Harden the control-plane trust boundary.** `/session/status` fields are
  strictly validated (nonce, destination IP, port, SNI, XHTTP path), control
  responses are capped and never follow redirects, and the tunnel destination
  is pinned to the compiled server — a compromised API can no longer redirect
  user traffic.
 - **Authenticated local SOCKS5 is now mandatory.** The ephemeral local proxy
  replaces rather than filters inbounds, so only the authenticated SOCKS5
  listener can exist.
 - **Fail closed on connection-mode changes.** The mode is persisted before it is
  applied, and a failed save leaves the UI and runtime unchanged instead of
  silently selecting a weaker route.
 ### Fixed
 - Connect button no longer leaks a listener into a disposed `AnimationController`
  during teardown.
 - Disclosure acknowledgement is only persisted once the user accepts it.
 - Session countdown now uses a monotonic clock (cannot be extended by rolling the
  device clock back) and a VPN error tears the tunnel down instead of freezing
  the timer on a live session.
 - The VPN-service notification's disconnect action and countdown re-post are
  aligned with the vendored runtime.
 ### Removed
 - Unsupported server-selector UI (single server today; design retained for
  multi-server later).
 - Unused Flutter dependencies and orphaned assets.
 - Dead Dart wrappers whose native handlers no longer exist.
 ### Security & privacy
 - IPv6 is captured by the VPN interface (`::/0` route), closing a leak where
  IPv6 traffic could bypass the tunnel on IPv6-capable carriers.
 ---
 ## [3.3.4] — 2026-09-02
 ### Added
 - **OS-level session-expiry enforcement.** The VPN service now holds an absolute
  deadline and tears the tunnel down on its own clock — a main-looper handler
  plus an `AlarmManager` exact alarm (falling back to an inexact alarm on
  Android 13+ when exact alarms aren't granted). The app pushes
  `now + expires_in_seconds` on each session sync, so a session ends even if the
  UI process has been killed.
 - **Session survival across process death.** The service persists the active
  session and re-establishes it when Android restarts it (`START_STICKY`).
 - **Support-ad extension reflected immediately.** A rewarded "Support us" ad now
  forces an immediate server sync, so the countdown and expiry deadline update
  without waiting for the next heartbeat.
 ### Changed
 - **Session-status beacon slowed.** Foreground poll: 5 s → 60 s; background poll:
  30 s → 60 s.
 - **Background-reliability guidance.** The "Always-on VPN" settings deep-link was
  removed; the battery-optimisation exemption remains, with expiry now enforced
  by the service itself.
 ### Removed
 - Legacy `ass` connection-mode migration — unrecognized persisted modes now
  default to TUN.
 ### Security & privacy
 - Session credentials and the per-user VLESS UUID are now held app-private on
  disk (`active_session.bin`) for the session's lifetime and removed on
  disconnect or expiry. Previously they were memory-only.
 ---
 ## [3.3.3] — 2026-09-01
 ### Fixed
 - **The session clock stayed at 00:00:00 on a live tunnel, and the notification
  countdown froze with it.** `SessionTimer` is built lazily, so when the app reattaches
  to a tunnel that outlived its UI process, `VpnConnection` had already reported
  "connected" before the timer existed — and a change listener does not replay events
  it was not present for. The timer now evaluates the current connection state once at
  construction instead of waiting for a transition, and is created eagerly alongside
  `VpnConnection`. Because the timer is what pushes text to the foreground
  notification, a stopped clock also meant a frozen countdown; both come from this.
 - Resuming the clock no longer requires `adoptedRunningRuntime` or a previous
  successful sync, both of which are false in a freshly started process. A connected
  tunnel with a stopped clock is now always treated as something to resume.
 ## [3.3.2] — 2026-09-01
 Background reliability. 3.3.1 could show "connected" against a tunnel that was no
 longer running; this release fixes the cause rather than the symptom, and removes the
 machinery that existed to work around it.
 ### Added
 - **Background reliability settings.** Android stops background services of apps that
  are not exempt from Doze, and tears down the process group when a task is swiped
  away. Two OS mechanisms prevent that, and the app now surfaces both: a one-tap
  **battery optimisation exemption**, and a deep link to Android's **Always-on VPN**
  settings (with a note about "Block connections without VPN"). Neither can be enabled
  programmatically — each needs a single user tap, once.
 ### Fixed
 - **The app could report "connected" with no traffic flowing.** Startup state came from
  `getConnectedServerDelay()`, which measures through
  `AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807`. `AppConfigs` lives in the VPN's
  own process, so from the UI process it is always null and the port always fell back to
  10807. That was accidentally correct while the SOCKS port was fixed; 3.3.1's
  per-session ephemeral ports made it permanently wrong. Liveness is now determined from
  the OS — whether our VPN service process is running, and whether a VPN transport is
  actually present.
 - **A frozen countdown could outlive the tunnel.** The foreground notification (id 1) is
  owned by the VPN service via `startForeground`, but the UI process was posting to the
  same id. When that process died, its notification stayed on screen with nothing left to
  update it. The app no longer posts for a runtime that is not alive, and clears a stale
  notification instead.
 ### Removed
 - **Standard/Extreme resilience modes** and the runtime-restart machinery behind them.
  Recovery ran off a disconnect broadcast delivered to the app process, so it could never
  fire in the case that actually matters — Android killing that process. It was
  complexity substituting for background persistence.
 - **Startup restoration**, including the config-snapshot rebuild. With the tunnel kept
  alive by the OS, there is nothing to restore; the app simply reports what is running.
 - The `resilience_mode` preference and its settings tile.
 ## [3.3.1] — 2026-08-31
 ### Added
 - **Explicit TUN and SOCKS5 connection modes.** The previous Auto mode is gone, so
  routing is chosen deliberately instead of inferred at runtime. TUN is the default.
  SOCKS5 runs a local authenticated proxy with no VPN interface, and therefore never
  requests the Android VPN permission.
 - **Authenticated per-session Local SOCKS5.** Every connection binds an ephemeral
  loopback port and mints fresh 16-byte username / 32-byte password credentials.
  Android loopback is reachable by every app on the device, so this authentication is
  load-bearing rather than decorative. Credentials stay in memory. Imported
  `socks`/`http` inbounds are dropped so no unauthenticated listener can survive
  alongside the session one.
 - **Network resilience profiles** — Standard and Extreme. Extreme restarts a failed
  Xray/tun2socks runtime up to twice before giving up.
 - **Android physical-network monitoring**, filtered on `NET_CAPABILITY_NOT_VPN` so the
  VPN's own network cannot feed back a reconnect loop. Informational only; the active
  transport (Wi-Fi / cellular / ethernet) now appears in the status bar.
 - **Local SOCKS5 diagnostics.** "Test Local SOCKS" authenticates against the exact
  active session over loopback — a readiness handshake plus a full CONNECT — instead
  of checking whether a fixed port accepts connections.
 - Native Android bridges for network state, haptic feedback and install-source
  detection.
 ### Fixed
 - **Extreme recovery now survives an app-process restart.** Android can kill the Dart
  process while the VPN foreground service keeps running, leaving the app attached to
  a live tunnel it holds no configuration for — so recovery had nothing to restart
  from. In TUN mode the app rebuilds that snapshot from the still-active session,
  without opening a new session, showing an ad, or interrupting traffic.
 - **The proxy settings tile no longer misreports state after a process restart.** Its
  credentials genuinely cannot be recovered — they are random, generated on device and
  never transmitted — so instead of telling an already-connected user to "Connect", it
  now says the credentials were lost and offers a Reconnect action.
 - **The first tap on the connect button was ignored.** The debounce timestamp was
  initialized to the current time instead of the epoch, so the first press was always
  swallowed.
 - **The health probe polled `/health` every 30 s even while connected.** Restored to
  idle-only — a live tunnel already proves reachability, and the extra direct requests
  were unwanted.
 - **A user reconnect could race an in-flight Extreme recovery.** A connection
  generation counter now aborts stale recovery attempts.
 - Recoverable Xray/tun2socks startup and readiness failures no longer follow the
  unstable self-stop path used during development.
 - Returning from Android background state reconciles the session countdown against
  elapsed wall-clock time and re-syncs immediately, reducing stale countdowns and false
  `Syncing…` presentation after Dart throttling.
 - Sidebar update checks retain valid navigator/messenger handles after the drawer
  closes.
 ### Changed
 - **The pinned `flutter_vless_android` 1.1.5 runtime is patched at build time** instead
  of vendored. Three idempotent patchers are chained into `preBuild`, so a plain
  `flutter build apk` behaves like CI rather than depending on a manual step against
  the pub cache. They are fail-closed: an upstream change breaks the build loudly
  instead of silently producing an unpatched runtime.
 - Legacy `auto` preferences migrate to TUN; legacy `ass` preferences migrate to SOCKS5.
 - Haptic feedback is a single confirmation on connect/disconnect, routed through the
  native Android vibration channel, and **defaults to off**.
 - The VPN notification uses a dedicated 24 dp status icon and stays ongoing/no-clear
  while the foreground service is alive.
 - Hivemind session parsing is split into typed validation steps; a malformed port now
  fails instead of silently falling back.
 - The update checker parses semver with prerelease ordering and validates release URLs
  against an HTTPS host allowlist.
 - The support button shows a claimed/disabled state once the session bonus is used.
 - The status bar distinguishes `Ready` from `Syncing…` and folds in server
  reachability.
 - Gradle release heap raised to 4 GiB with `MaxMetaspaceSize=1g` and `workers.max=2`,
  so Flutter/Jetifier transforms do not fail on the release classpath under constrained
  runners.
 - App version is now `3.3.1+27`.
 ### Removed
 - **Per-app routing**, including the app picker, the installed-apps native bridge and
  the blocked-apps mechanism. It only ever functioned in TUN — the underlying
  `addDisallowedApplication` call lives inside the VPN-interface setup that SOCKS5 mode
  skips entirely — and its allowlist half was never wired to any caller. Removed rather
  than finished.
 - The legacy `auto` connection mode.
 - `flutter_local_notifications`, and the unused notification manager it backed.
 - A global touch listener that fired a haptic on every tap.
 - Unused runtime telemetry fields.
 ### Security & privacy
 - **Session metadata is hidden from public lock-screen previews.** The live foreground
  notification is built with `VISIBILITY_PRIVATE` plus a generic public version, so the
  countdown and speed are visible only after unlock. *(An earlier attempt at this
  landed in an unreferenced class and never took effect.)*
 - Local SOCKS5 listens only on `127.0.0.1`, requires per-session authentication, and
  its credentials are neither persisted nor logged.
 - The app requests no package visibility at all. `QUERY_ALL_PACKAGES` was never used,
  and the launcher-enumeration query was removed along with the app picker.
 - Session nonces use `Random.secure()` and are never logged.
 - Device UUIDs are validated as v4 and regenerated if corrupt, so tampered identifiers
  cannot reach the API.
 - `FOREGROUND_SERVICE_SPECIAL_USE` is declared for Android 14+; the merged service
  declaration carries the `vpn` special-use subtype.
 - Existing AdMob bypass/callback behavior is intentionally unchanged by this release.
 - Server, nginx and Reality configuration are not modified by this client-side release.
 ### Validation
 - `flutter analyze` — 0 errors, 0 warnings, 7 style infos (6 of them pre-existing).
 - All three build-time patchers verified against a clean pub cache, including that each
  applies independently of the others.
 - **Not yet verified:** Android release Kotlin compilation and APK build.
 ## [3.3.0] — 2026-08-30
 ### Added
 - Session countdown in the VPN notification, updated each second while connected.
 ### Fixed
 - **Session-expiry desync** — the app could show "Online" with no internet after
  the server ended the session. The countdown no longer freezes when a poll fails.
 - **Notification Disconnect button** disappeared a second after connecting.
  Re-posting the foreground notification replaces it wholesale, so the action,
  colour and tap-intent flutter_vless sets are now rebuilt rather than dropped.
 - **Speed readout** divided the byte delta by the nominal poll interval instead of
  the real time between polls — wrong by up to 6x around every background switch.
 - **Settings toggles** now apply at launch. Rain, lightning and haptics were only
  read from disk when Settings mounted, so an effect turned off came back — ticker
  and all — on every relaunch, and haptic feedback did nothing until Settings had
  been opened at least once.
 - **Haptic feedback** now fires `mediumImpact()` instead of `lightImpact()` (which
  is imperceptible on many Android devices), wrapped best-effort so a platform
  vibration failure cannot fail a connect/disconnect, with a preview tap when the
  toggle is switched on.
 - First-launch disclosure dialog said data was linked to "your account". It is
  linked to a randomly generated device ID, and the policy is in the sidebar, not
  on a website.
 - Sidebar "Settings" and "Check for updates" used the drawer's context after
  `Navigator.pop()` — a defunct context. They now capture the root navigator (and
  messenger) before closing the drawer. *(Fix ported from Naveax's review.)*
 ### Performance
 - Rain overlay ticks only while enabled, repaints through a scoped `Listenable`
  instead of rebuilding every frame, and precomputes drop colours.
 - Lightning no longer fires strikes while disabled.
 - Connect button pulse pauses when backgrounded; brand image hoisted out of the
  per-frame rebuild.
 - Server poll drops to 30 s while backgrounded (5 s foreground), with an immediate
  re-sync on resume. The 1 s countdown keeps running.
 - Health probe runs only while disconnected, and pauses in the background.
 - Speed and support widgets rebuild on value change instead of every second.
 - Notification channel is created once per process, not once per second.
 ### Changed
 - VLESS engine initializes under the splash screen; the intro waits on
  `VpnConnection.ready` (8 s cap) before showing the main screen.
 - AdMob SDK init moved off the blocking pre-`runApp()` path so startup cannot hang
  on an unreachable Google endpoint.
 - `app_config.example.dart` drops the dead bootstrap fields and documents
  `hivemindApiPublic` in their place.
 - `.gitignore` reorganized around type and directory rules; the enumerated
  filename list is gone (redundant with the type rules) and `.claude/` is now
  ignored.
 ### Security
 - Update checker pins the release URL to this repo's path on `github.com`, not just
  the host. Anything else falls back to the releases page.
 - Notification timer updates are gated on a live tunnel, so a late tick cannot leave
  an ongoing notification with no foreground service behind it.
 - Dropped `READ_EXTERNAL_STORAGE`, which `flutter_vless` pulls in but the app never uses
  (least privilege).
 - Pinned the Gradle 8.14 distribution SHA-256; `validateDistributionUrl` enabled
  (supply-chain integrity).
 ### Build & tooling (ported from Naveax)
 - Removed the deprecated `android.enableR8` flag.
 - Added `analysis_options.yaml` (flutter_lints, `local_packages/**` excluded, `avoid_print`).
 - Added `.gitattributes` to pin LF line endings repo-wide.
 - Credit: reviewed and ported from **Naveax**.
 ### Docs
 - Privacy policy: disclosed that the server sees the connecting IP, corrected the
  "stored in memory" claim, and documented consent being changeable from the sidebar.
 ## [3.2.2] — 2026-08-08
 ### Fixed
 - Updated Discord invite link.
 ## [3.2.1] — 2026-08-08
 ### Google Play compliance
@@ -14,7 +14,7 @@ As a contributor, here are the guidelines we would like you to follow:
  │       │             │
  │       │             └─⫸ Summary in present tense. Not capitalized. No period at the end.
  │       │
-  │       └─⫸ Commit Scope: app|server|xray|nginx|docs|config
+  │       └─⫸ Commit Scope: app|docs|config
  │
  └─⫸ Commit Type: build|ci|docs|feat|fix|perf|refactor|test
 ```
@@ -40,12 +40,12 @@ Must be one of the following:
 The scope should be the part of the project affected:
 * `app` — Flutter client (screens, components, logic)
 * `server` — Python Hivemind backend
 * `xray` — Xray Reality config or tunnel behavior
 * `nginx` — nginx routing, SSL, auth
 * `docs` — documentation files
 * `config` — app_config, .gitignore, pubspec
 The `server`, `xray` and `nginx` components are not in this repository, so
 contributions targeting them cannot be reviewed or tested here.
 ##### Summary
 Use the summary field to provide a succinct description of the change:
@@ -65,10 +65,9 @@ You can include a comparison of the previous behavior with the new behavior in o
 #### Examples
 ```
-feat(server): add swarm monitoring endpoint
+feat(app): add a server selector to the settings screen
-GET /api/swarm returns sorted drone list for the TUI dashboard.
+Lists the available exit locations and persists the user's choice locally.
 Persistent total GB saved to swarm_total.json, survives restarts.
 ```
 ```
@@ -1,33 +1,48 @@
 # Privacy Policy
-**Last updated:** August 2026
+**Last updated:** September 2026
 ReVoltVPN is a free VPN service built and operated by ReVolt Team.
 ## In-app disclosure
 When you first open the app, we show a brief summary of this policy before you connect. You can review this full policy at any time from the sidebar menu.
 ## What we collect
 We collect the minimum required to operate the service:
 - A randomly generated device ID created on your phone. This is not linked to your identity in any way.
- Your active session status and data usage for the current session only. Sessions last up to 1 hour, then expire. Session data is stored in memory and deleted when your session ends.
+- Your connection duration and data usage for the current session, linked to your device ID. This is used solely to enforce the per-session quota (see below).
 ## What our server sees
 To start, check, or refresh your session, the app contacts our API directly rather than through the VPN tunnel. Our server therefore sees the IP address you are connecting from, alongside your device ID, for as long as the app is running. This is a necessary consequence of how sessions are issued and kept alive — it is separate from your browsing traffic, which is carried inside the tunnel and is described below.
 ## Session quotas
 Each session lasts up to **2 hours** or **10 GB** of data — whichever comes first. When your session expires or hits the data cap, the tunnel disconnects. You can start a new session by watching another ad. Session records (duration and bytes transferred) are held on our server for the life of your session and removed when it ends.
 Support ads (the "Support us" button) extend an active session by 30 minutes and add extra data allowance.
 ## Operational logs
-We keep a short in-memory log buffer (last 200 lines) for debugging and server health monitoring. These logs include truncated device IDs (first 8 characters only), session start/stop events, and error messages. Logs never leave the server, are not retained after a server restart, and are only accessible to the server operator via local console. We also maintain an aggregate total of all data ever transferred (in GB) for capacity planning — this counter is not tied to any individual device.
+Server logs are written to the systemd journal (`journalctl -u hivemind`). These logs include truncated device IDs (first 8 characters only), session start/stop events, and error messages. Logs stay on the server and are accessible only to the server operator via local console; retention follows the server's systemd journal settings. We also maintain an aggregate total of all data ever transferred (in GB) for capacity planning — this counter is not tied to any individual device.
 ## What we do not collect
 - We do not collect your name, email, or any personal information.
- We do not log your internet traffic or browsing history.
+- We do not log your internet traffic, browsing history, DNS queries, or destination IPs.
 - We do not inspect or store the content of your traffic.
 - We do not sell or share any data with third parties.
 ## Ads & Consent
-ReVoltVPN uses Google AdMob to display rewarded video ads. On first launch, users in the European Economic Area (EEA) and United Kingdom are shown a consent dialog (provided by Google's User Messaging Platform) that lets them choose whether to allow personalized ads. This consent choice is stored on your device and can be changed at any time by reinstalling the app. Google may collect data as part of ad delivery. Please refer to Google's Privacy Policy for details.
+ReVoltVPN uses Google AdMob to display rewarded video ads. Where required — for users in the European Economic Area (EEA) and United Kingdom — a consent dialog provided by Google's User Messaging Platform is shown before the first ad is requested, letting you choose whether to allow personalized ads. This choice is stored on your device and can be reviewed at any time from the "Ad Consent" entry in the sidebar menu. Google may collect data as part of ad delivery. Please refer to Google's Privacy Policy for details.
 ## Your traffic
-Your internet traffic is routed through our server located in Finland. We do not inspect, log, or store your traffic. We only track total bytes transferred per session (for quota enforcement and blocking abusers) — no packet contents, no destination IPs, no DNS queries.
+Your internet traffic is routed through our server located in Finland. We do not inspect, log, or store your traffic. We only track total bytes transferred per session for quota enforcement — no packet contents, no destination IPs, no DNS queries.
 ## Contact
@@ -4,7 +4,7 @@
 # ReVoltVPN
-A free VPN app for Android. Open-source client, transparent infrastructure. Watch an ad, get 60 minutes of full-speed traffic — no accounts, no logs, no subscriptions.
+A free VPN app for Android. Open-source client, transparent infrastructure. Watch an ad, get 2 hours of full-speed traffic — no accounts, no logs, no subscriptions.
 ---
@@ -23,7 +23,7 @@ No email. No password. No payment. The ad pays for the server.
 ## Protocol
 - **Transport** — VLESS over XHTTP (HTTP/2 multiplexed, path-hidden behind `/revolt`)
- **Obfuscation** — Xray Reality spoofs `www.github.com` TLS. To any DPI box, your tunnel looks like a browser visiting GitHub
+- **Obfuscation** — Xray Reality spoofs a real website's TLS. To any DPI box, your tunnel looks like a browser visiting that website
 - **Encryption** — TLS 1.3 with borrowed certificate (Reality). No certbot, no domain ownership required
 - **API** — Standard HTTPS to a separate domain. Tunnel destination is IP-pinned — domain compromise is DoS only
@@ -0,0 +1,12 @@
 include: package:flutter_lints/flutter.yaml
 analyzer:
  exclude:
    - build/**
    - android/**
    - local_packages/**
    - whatsthis/**
 linter:
  rules:
    avoid_print: true
@@ -1,11 +1,18 @@
 import java.util.Properties
 import java.io.File
 import java.io.FileInputStream
 import java.security.MessageDigest
 plugins {
    id("com.android.application")
    id("dev.flutter.flutter-gradle-plugin")
 }
 fun sha256Hex(file: File): String {
    val digest = MessageDigest.getInstance("SHA-256").digest(file.readBytes())
    return digest.joinToString("") { "%02x".format(it.toInt() and 0xff) }
 }
 android {
    namespace = "com.paladinvpn.app"
    compileSdk = flutter.compileSdkVersion
@@ -17,10 +24,6 @@ android {
        targetCompatibility = JavaVersion.VERSION_17
    }
    packaging {
        resources.excludes.add("META-INF/**")
    }
    val keystorePropertiesFile = rootProject.file("key.properties")
    val keystoreProperties = Properties()
    if (keystorePropertiesFile.exists()) {
@@ -33,6 +36,68 @@ android {
        admobProperties.load(FileInputStream(admobPropertiesFile))
    }
    // Explicit opt-in used only by GitHub Actions to exercise the real
    // release/R8 graph. Production release signing and config pinning remain
    // fail-closed outside that CI smoke path.
    val ciReleaseSmoke =
        System.getenv("GITHUB_ACTIONS") == "true" &&
            System.getenv("REVOLT_CI_RELEASE_SMOKE") == "true"
    val appConfigFile = rootProject.file("../lib/logic/app_config.dart")
    val verifyReleaseAppConfig = tasks.register("verifyReleaseAppConfig") {
        group = "verification"
        description = "Verify the production Dart app config against REVOLT_APP_CONFIG_SHA256."
        doLast {
            if (ciReleaseSmoke) {
                logger.lifecycle("Skipping production app-config pin for CI release smoke build")
                return@doLast
            }
            val expected = System.getenv("REVOLT_APP_CONFIG_SHA256")?.trim()?.lowercase()
            if (expected.isNullOrEmpty()) {
                throw org.gradle.api.GradleException(
                    "REVOLT_APP_CONFIG_SHA256 is required for production release builds"
                )
            }
            if (!Regex("[0-9a-f]{64}").matches(expected)) {
                throw org.gradle.api.GradleException(
                    "REVOLT_APP_CONFIG_SHA256 must be exactly 64 lowercase hexadecimal characters"
                )
            }
            if (!appConfigFile.isFile) {
                throw org.gradle.api.GradleException(
                    "Production app config is missing: ${appConfigFile.absolutePath}"
                )
            }
            val configText = appConfigFile.readText()
            val templateMarkers = listOf(
                "'0.0.0.0'",
                "YOUR_DOMAIN",
                "YOUR_GITHUB_USERNAME",
                "YOUR_REPO_NAME",
                "ca-app-pub-0000000000000000/0000000000",
            )
            val remainingMarker = templateMarkers.firstOrNull(configText::contains)
            if (remainingMarker != null) {
                throw org.gradle.api.GradleException(
                    "Production app config still contains template marker: $remainingMarker"
                )
            }
            val actual = sha256Hex(appConfigFile)
            if (actual != expected) {
                throw org.gradle.api.GradleException(
                    "Production app config SHA-256 mismatch: expected $expected, got $actual"
                )
            }
        }
    }
    tasks.matching { it.name == "preReleaseBuild" }.configureEach {
        dependsOn(verifyReleaseAppConfig)
    }
    defaultConfig {
        applicationId = "com.paladinvpn.app"
        minSdk = flutter.minSdkVersion
@@ -53,7 +118,11 @@ android {
    buildTypes {
        release {
-            signingConfig = signingConfigs.getByName("release")
+            signingConfig = if (ciReleaseSmoke) {
                signingConfigs.getByName("debug")
            } else {
                signingConfigs.getByName("release")
            }
            isMinifyEnabled = true
            isShrinkResources = true
            proguardFiles(
@@ -1,4 +1,4 @@
-# PaladinVPN ProGuard / R8 Rules
+# ReVoltVPN ProGuard / R8 Rules
 # ==============================================================================
 # These rules prevent R8 from stripping classes and methods that are accessed
 # via JNI (Java Native Interface) or reflection, which would cause
@@ -11,9 +11,8 @@
 -keep class xray.** { *; }
 # ── Flutter / Platform Channels ───────────────────────────────────────────────
 # io.flutter.** already includes embedding and plugin subpackages.
 -keep class io.flutter.** { *; }
 -keep class io.flutter.embedding.** { *; }
 -keep class io.flutter.plugin.** { *; }
 # ── Google Mobile Ads (AdMob) ─────────────────────────────────────────────────
 -keep class com.google.android.gms.ads.** { *; }
@@ -1,11 +1,21 @@
-<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools">
    <uses-permission android:name="android.permission.INTERNET"/>
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
    <uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
-   <!-- VpnService provides its own system notification; SPECIAL_USE is not needed -->
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE"/>
-   <!-- Required by url_launcher on Android 11+ to open external browser -->
+    <uses-permission android:name="android.permission.VIBRATE"/>
    <!-- Doze/App Standby stop background services of non-exempt apps. A VPN
         cannot stay up without this; Play allows it for VPN functionality. -->
    <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS"/>
    <!-- flutter_vless 1.1.5 declares this legacy permission. ReVolt never needs it. -->
    <uses-permission
        android:name="android.permission.READ_EXTERNAL_STORAGE"
        tools:node="remove"/>
    <queries>
        <intent>
            <action android:name="android.intent.action.VIEW"/>
@@ -21,7 +31,6 @@
        android:allowBackup="false"
        android:extractNativeLibs="true">
        <!-- AdMob App ID — injected at build time from android/admob.properties -->
        <meta-data
            android:name="com.google.android.gms.ads.APPLICATION_ID"
            android:value="${ADMOB_APP_ID}"/>
@@ -36,16 +45,15 @@
            android:windowSoftInputMode="adjustResize">
            <meta-data
                android:name="io.flutter.embedding.android.NormalTheme"
-              android:resource="@style/NormalTheme"
+                android:resource="@style/NormalTheme"/>
              />
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>
        <meta-data
            android:name="flutterEmbedding"
-            android:value="2" />
+            android:value="2"/>
    </application>
 </manifest>
@@ -1,5 +1,426 @@
 package com.paladinvpn.app
 import android.app.Notification
 import android.app.NotificationChannel
 import android.app.NotificationManager
 import android.app.PendingIntent
 import android.content.Context
 import android.content.Intent
 import android.content.pm.PackageManager
 import android.net.ConnectivityManager
 import android.net.Network
 import android.net.NetworkCapabilities
 import android.net.NetworkRequest
 import android.net.Uri
 import android.os.Build
 import android.os.PowerManager
 import android.os.VibrationEffect
 import android.os.Vibrator
 import android.os.VibratorManager
 import android.provider.Settings
 import androidx.core.app.NotificationCompat
 import androidx.core.app.NotificationManagerCompat
 import com.github.tfox.flutter_vless.xray.utils.RevoltAlerts
 import io.flutter.embedding.android.FlutterActivity
 import io.flutter.embedding.engine.FlutterEngine
 import io.flutter.plugin.common.EventChannel
 import io.flutter.plugin.common.MethodChannel
-class MainActivity : FlutterActivity()
+class MainActivity : FlutterActivity() {
    private val installerChannel = "com.revoltvpn.app/installer"
    private val notificationChannel = "com.revoltvpn.app/notification"
    private val hapticsChannel = "com.revoltvpn.app/haptics"
    private val networkChannel = "com.revoltvpn.app/network"
    private val powerChannel = "com.revoltvpn.app/power"
    private var notificationChannelReady = false
    private var networkCallback: ConnectivityManager.NetworkCallback? = null
    private var networkEvents: EventChannel.EventSink? = null
    override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
        super.configureFlutterEngine(flutterEngine)
        MethodChannel(flutterEngine.dartExecutor.binaryMessenger, installerChannel)
            .setMethodCallHandler { call, result ->
                if (call.method == "getInstallerPackage") {
                    result.success(installerPackage())
                } else {
                    result.notImplemented()
                }
            }
        MethodChannel(flutterEngine.dartExecutor.binaryMessenger, powerChannel)
            .setMethodCallHandler { call, result ->
                when (call.method) {
                    "isIgnoringBatteryOptimizations" ->
                        result.success(isIgnoringBatteryOptimizations())
                    "requestIgnoreBatteryOptimizations" ->
                        result.success(requestIgnoreBatteryOptimizations())
                    else -> result.notImplemented()
                }
            }
        MethodChannel(flutterEngine.dartExecutor.binaryMessenger, notificationChannel)
            .setMethodCallHandler { call, result ->
                when (call.method) {
                    "updateNotificationText" -> {
                        val text = call.argument<String>("text") ?: ""
                        val title = call.argument<String>("title") ?: "Revolt VPN"
                        val action = call.argument<String>("disconnectLabel") ?: "Disconnect"
                        updateVpnNotification(title, text, action)
                        result.success(null)
                    }
                    // Session ends only Dart sees; the service posts the rest.
                    "showDisconnectedAlert" -> {
                        RevoltAlerts.postDisconnected(this)
                        result.success(null)
                    }
                    // The countdown re-post is ongoing and non-dismissible, so
                    // whoever posted it last has to take it down. A tick that
                    // lands after the service cancelled its own foreground
                    // notification otherwise strands a frozen countdown that
                    // claims a protected session forever. Harmless while the
                    // service is still in the foreground - the platform keeps
                    // its notification regardless.
                    "cancelNotification" -> {
                        (getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager)
                            .cancel(NOTIFICATION_ID)
                        result.success(null)
                    }
                    else -> result.notImplemented()
                }
            }
        MethodChannel(flutterEngine.dartExecutor.binaryMessenger, hapticsChannel)
            .setMethodCallHandler { call, result ->
                if (call.method == "impact") {
                    val kind = call.argument<String>("kind") ?: "tap"
                    result.success(performHaptic(kind))
                } else {
                    result.notImplemented()
                }
            }
        EventChannel(flutterEngine.dartExecutor.binaryMessenger, networkChannel)
            .setStreamHandler(object : EventChannel.StreamHandler {
                override fun onListen(arguments: Any?, events: EventChannel.EventSink?) {
                    networkEvents = events
                    startNetworkMonitor()
                }
                override fun onCancel(arguments: Any?) {
                    networkEvents = null
                    stopNetworkMonitor()
                }
            })
    }
    override fun onDestroy() {
        stopNetworkMonitor()
        super.onDestroy()
    }
    private fun isIgnoringBatteryOptimizations(): Boolean {
        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true
        return try {
            val pm = getSystemService(Context.POWER_SERVICE) as PowerManager
            pm.isIgnoringBatteryOptimizations(packageName)
        } catch (_: Exception) {
            false
        }
    }
    private fun requestIgnoreBatteryOptimizations(): Boolean {
        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) return true
        if (isIgnoringBatteryOptimizations()) return true
        return try {
            startActivity(
                Intent(
                    Settings.ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS,
                    Uri.parse("package:$packageName"),
                ),
            )
            true
        } catch (_: Exception) {
            try {
                startActivity(Intent(Settings.ACTION_IGNORE_BATTERY_OPTIMIZATION_SETTINGS))
                true
            } catch (_: Exception) {
                false
            }
        }
    }
    private fun updateVpnNotification(title: String, text: String, actionLabel: String) {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
            checkSelfPermission(android.Manifest.permission.POST_NOTIFICATIONS) !=
                PackageManager.PERMISSION_GRANTED
        ) {
            return
        }
        ensureNotificationChannel()
        val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
            PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT
        } else {
            PendingIntent.FLAG_UPDATE_CURRENT
        }
        val launchIntent = packageManager.getLaunchIntentForPackage(packageName)
        launchIntent?.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or
            Intent.FLAG_ACTIVITY_CLEAR_TOP or
            Intent.FLAG_ACTIVITY_NEW_TASK
        // The VPN service owns the authoritative Disconnect PendingIntent and
        // embeds the current runtime-generation token in it. Never recreate an
        // unscoped STOP intent from the UI process: a stale notification could
        // otherwise stop a newer tunnel. Reuse the live service action when the
        // platform exposes it; on older Android versions omit the action rather
        // than weaken generation scoping.
        val manager = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
        val serviceStopAction = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
            manager.activeNotifications
                .firstOrNull { it.id == NOTIFICATION_ID }
                ?.notification
                ?.actions
                ?.firstOrNull()
                ?.actionIntent
        } else {
            null
        }
        val publicVersion = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID)
            .setSmallIcon(R.drawable.notification_icon)
            .setContentTitle("Revolt VPN")
            .setContentText("VPN is active")
            .build()
        val builder = NotificationCompat.Builder(this, NOTIFICATION_CHANNEL_ID)
            .setSmallIcon(R.drawable.notification_icon)
            .setContentTitle(title)
            .setContentText(text)
            .setColorized(true)
            .setColor(0xFF0D1117.toInt())
            .setOngoing(true)
            .setAutoCancel(false)
            .setOnlyAlertOnce(true)
            .setSilent(true)
            .setShowWhen(false)
            .setPriority(NotificationCompat.PRIORITY_LOW)
            .setVisibility(NotificationCompat.VISIBILITY_PRIVATE)
            .setPublicVersion(publicVersion)
        if (serviceStopAction != null) {
            builder.addAction(0, actionLabel, serviceStopAction)
        }
        if (launchIntent != null) {
            builder.setContentIntent(PendingIntent.getActivity(this, 0, launchIntent, flags))
        }
        try {
            val notification = builder.build()
            notification.flags = notification.flags or
                Notification.FLAG_ONGOING_EVENT or Notification.FLAG_NO_CLEAR
            NotificationManagerCompat.from(this).notify(NOTIFICATION_ID, notification)
        } catch (_: Exception) {
            // The native foreground notification may not be ready yet.
        }
    }
    private fun ensureNotificationChannel() {
        if (notificationChannelReady) return
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
            val manager = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
            val channel = NotificationChannel(
                NOTIFICATION_CHANNEL_ID,
                "Revolt VPN Background Service",
                NotificationManager.IMPORTANCE_LOW,
            )
            channel.setShowBadge(false)
            manager.createNotificationChannel(channel)
        }
        notificationChannelReady = true
    }
    private fun startNetworkMonitor() {
        if (networkCallback != null) return
        val manager = getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
        val callback = object : ConnectivityManager.NetworkCallback() {
            override fun onAvailable(network: Network) {
                emitBestPhysicalNetwork(manager, "available")
            }
            override fun onLost(network: Network) {
                emitBestPhysicalNetwork(manager, "lost")
            }
            override fun onCapabilitiesChanged(
                network: Network,
                capabilities: NetworkCapabilities,
            ) {
                emitBestPhysicalNetwork(manager, "changed")
            }
        }
        try {
            val request = NetworkRequest.Builder()
                .addCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)
                .addCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN)
                .build()
            manager.registerNetworkCallback(request, callback)
            networkCallback = callback
            emitBestPhysicalNetwork(manager, "initial")
        } catch (e: Exception) {
            networkEvents?.error("NETWORK_MONITOR", e.message, null)
        }
    }
    private fun stopNetworkMonitor() {
        val callback = networkCallback ?: return
        val manager = getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
        try {
            manager.unregisterNetworkCallback(callback)
        } catch (_: Exception) {
        }
        networkCallback = null
    }
    private fun emitBestPhysicalNetwork(
        manager: ConnectivityManager,
        reason: String,
    ) {
        val best = manager.allNetworks
            .mapNotNull { network ->
                val capabilities = manager.getNetworkCapabilities(network)
                    ?: return@mapNotNull null
                if (!capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_INTERNET)) {
                    return@mapNotNull null
                }
                if (!capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_VPN) ||
                    capabilities.hasTransport(NetworkCapabilities.TRANSPORT_VPN)
                ) {
                    return@mapNotNull null
                }
                Triple(network, capabilities, physicalNetworkScore(capabilities))
            }
            .maxByOrNull { it.third }
        if (best == null) {
            emitNetworkPayload(
                mapOf<String, Any>(
                    "reason" to reason,
                    "transport" to "none",
                    "connected" to false,
                    "validated" to false,
                    "metered" to false,
                    "timestamp" to System.currentTimeMillis(),
                ),
            )
            return
        }
        emitNetworkState(best.first, best.second, reason)
    }
    private fun physicalNetworkScore(capabilities: NetworkCapabilities): Int {
        var score = 0
        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M ||
            capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED)
        ) {
            score += 100
        }
        score += when {
            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_ETHERNET) -> 40
            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_WIFI) -> 30
            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_CELLULAR) -> 20
            else -> 10
        }
        return score
    }
    private fun emitNetworkState(
        network: Network,
        capabilities: NetworkCapabilities,
        reason: String,
    ) {
        val transport = when {
            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_ETHERNET) -> "ethernet"
            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_WIFI) -> "wifi"
            capabilities.hasTransport(NetworkCapabilities.TRANSPORT_CELLULAR) -> "cellular"
            else -> "other"
        }
        val validated = Build.VERSION.SDK_INT < Build.VERSION_CODES.M ||
            capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_VALIDATED)
        val metered = !capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_METERED)
        emitNetworkPayload(
            mapOf<String, Any>(
                "reason" to reason,
                "transport" to transport,
                "connected" to true,
                "validated" to validated,
                "metered" to metered,
                "timestamp" to System.currentTimeMillis(),
            ),
        )
    }
    private fun emitNetworkPayload(payload: Map<String, Any>) {
        runOnUiThread { networkEvents?.success(payload) }
    }
    private fun installerPackage(): String? = try {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
            packageManager.getInstallSourceInfo(packageName).installingPackageName
        } else {
            @Suppress("DEPRECATION")
            packageManager.getInstallerPackageName(packageName)
        }
    } catch (_: Exception) {
        null
    }
    private fun performHaptic(kind: String): Boolean {
        return try {
            val vibrator: Vibrator = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
                val manager =
                    getSystemService(Context.VIBRATOR_MANAGER_SERVICE) as VibratorManager
                manager.defaultVibrator
            } else {
                @Suppress("DEPRECATION")
                getSystemService(Context.VIBRATOR_SERVICE) as Vibrator
            }
            if (!vibrator.hasVibrator()) {
                false
            } else {
                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
                    val effect = when (kind) {
                        "selection" -> VibrationEffect.EFFECT_TICK
                        "success" -> VibrationEffect.EFFECT_HEAVY_CLICK
                        else -> VibrationEffect.EFFECT_CLICK
                    }
                    vibrator.vibrate(VibrationEffect.createPredefined(effect))
                } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
                    val durationMs = if (kind == "success") 24L else 14L
                    val amplitude = if (kind == "success") 110 else 70
                    vibrator.vibrate(VibrationEffect.createOneShot(durationMs, amplitude))
                } else {
                    @Suppress("DEPRECATION")
                    vibrator.vibrate(if (kind == "success") 24L else 14L)
                }
                true
            }
        } catch (_: Exception) {
            false
        }
    }
    companion object {
        private const val NOTIFICATION_ID = 1
        private const val NOTIFICATION_CHANNEL_ID = "REVOLT_VPN_SERVICE"
    }
 }
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <shape xmlns:android="http://schemas.android.com/apk/res/android"
    android:shape="rectangle">
-    <solid android:color="#0d1017" />
+    <solid android:color="@color/splash_bg" />
 </shape>
@@ -0,0 +1,9 @@
 <vector xmlns:android="http://schemas.android.com/apk/res/android"
    android:width="24dp"
    android:height="24dp"
    android:viewportWidth="24"
    android:viewportHeight="24">
    <path
        android:fillColor="#FFFFFFFF"
        android:pathData="M12,1.5L21,5.2V11.1C21,16.7 17.4,21 12,22.5C6.6,21 3,16.7 3,11.1V5.2L12,1.5ZM12,5L6.5,7.2V11C6.5,14.8 8.7,17.8 12,19C15.3,17.8 17.5,14.8 17.5,11V7.2L12,5ZM10.8,9H13.2V13.8H10.8V9ZM10.8,15H13.2V17.4H10.8V15Z" />
 </vector>
@@ -0,0 +1,16 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
    <style name="LaunchTheme" parent="@android:style/Theme.Black.NoTitleBar">
        <item name="android:windowSplashScreenBackground">@color/splash_bg</item>
        <item name="android:windowBackground">@color/splash_bg</item>
        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
        <item name="android:statusBarColor">@color/splash_bg</item>
        <item name="android:navigationBarColor">@color/splash_bg</item>
    </style>
    <style name="NormalTheme" parent="@android:style/Theme.Black.NoTitleBar">
        <item name="android:windowBackground">@color/splash_bg</item>
        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
        <item name="android:statusBarColor">@color/splash_bg</item>
        <item name="android:navigationBarColor">@color/splash_bg</item>
    </style>
 </resources>
@@ -1,18 +1,15 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
    <!-- Theme applied to the Android Window while the process is starting when the OS's Dark Mode setting is on -->
    <style name="LaunchTheme" parent="@android:style/Theme.Black.NoTitleBar">
        <!-- Show a splash screen on the activity. Automatically removed when
             the Flutter engine draws its first frame -->
        <item name="android:windowBackground">@drawable/launch_background</item>
        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
        <item name="android:statusBarColor">@color/splash_bg</item>
        <item name="android:navigationBarColor">@color/splash_bg</item>
    </style>
    <!-- Theme applied to the Android Window as soon as the process has started.
         This theme determines the color of the Android Window while your
         Flutter UI initializes, as well as behind your Flutter UI while its
         running.
         This Theme is only used starting with V2 of Flutter's Android embedding. -->
    <style name="NormalTheme" parent="@android:style/Theme.Black.NoTitleBar">
-        <item name="android:windowBackground">?android:colorBackground</item>
+        <item name="android:windowBackground">@color/splash_bg</item>
        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
        <item name="android:statusBarColor">@color/splash_bg</item>
        <item name="android:navigationBarColor">@color/splash_bg</item>
    </style>
 </resources>
@@ -0,0 +1,16 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
    <style name="LaunchTheme" parent="@android:style/Theme.Black.NoTitleBar">
        <item name="android:windowSplashScreenBackground">@color/splash_bg</item>
        <item name="android:windowBackground">@color/splash_bg</item>
        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
        <item name="android:statusBarColor">@color/splash_bg</item>
        <item name="android:navigationBarColor">@color/splash_bg</item>
    </style>
    <style name="NormalTheme" parent="@android:style/Theme.Black.NoTitleBar">
        <item name="android:windowBackground">@color/splash_bg</item>
        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
        <item name="android:statusBarColor">@color/splash_bg</item>
        <item name="android:navigationBarColor">@color/splash_bg</item>
    </style>
 </resources>
@@ -1,18 +1,15 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
    <!-- Theme applied to the Android Window while the process is starting -->
    <style name="LaunchTheme" parent="@android:style/Theme.Black.NoTitleBar">
        <!-- Show a splash screen on the activity. Automatically removed when
             Flutter draws its first frame -->
        <item name="android:windowBackground">@drawable/launch_background</item>
        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
        <item name="android:statusBarColor">@color/splash_bg</item>
        <item name="android:navigationBarColor">@color/splash_bg</item>
    </style>
    <!-- Theme applied to the Android Window as soon as the process has started.
         This theme determines the color of the Android Window while your
         Flutter UI initializes, as well as behind your Flutter UI while its
         running.
         This Theme is only used starting with V2 of Flutter's Android embedding. -->
    <style name="NormalTheme" parent="@android:style/Theme.Black.NoTitleBar">
        <item name="android:windowBackground">@color/splash_bg</item>
        <item name="android:windowDrawsSystemBarBackgrounds">true</item>
        <item name="android:statusBarColor">@color/splash_bg</item>
        <item name="android:navigationBarColor">@color/splash_bg</item>
    </style>
 </resources>
@@ -1,8 +1,7 @@
-org.gradle.jvmargs=-Xmx1536M
+org.gradle.jvmargs=-Xmx4g -XX:MaxMetaspaceSize=1g -Dfile.encoding=UTF-8
-android.enableR8=true
+org.gradle.workers.max=2
 android.useAndroidX=true
 android.enableJetifier=true
-# This builtInKotlin flag was added automatically by Flutter migrator
+# These compatibility flags are managed by Flutter's Android toolchain.
 android.builtInKotlin=false
 # This newDsl flag was added automatically by Flutter migrator
 android.newDsl=false
@@ -3,3 +3,6 @@ distributionPath=wrapper/dists
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
 distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-all.zip
 distributionSha256Sum=efe9a3d147d948d7528a9887fa35abcf24ca1a43ad06439996490f77569b02d1
 networkTimeout=10000
 validateDistributionUrl=true
@@ -0,0 +1,251 @@
 #!/bin/sh
 #
 # Copyright © 2015-2021 the original authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
 #      https://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
 # SPDX-License-Identifier: Apache-2.0
 #
 ##############################################################################
 #
 #   Gradle start up script for POSIX generated by Gradle.
 #
 #   Important for running:
 #
 #   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
 #       noncompliant, but you have some other compliant shell such as ksh or
 #       bash, then to run this script, type that shell name before the whole
 #       command line, like:
 #
 #           ksh Gradle
 #
 #       Busybox and similar reduced shells will NOT work, because this script
 #       requires all of these POSIX shell features:
 #         * functions;
 #         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
 #           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
 #         * compound commands having a testable exit status, especially «case»;
 #         * various built-in commands including «command», «set», and «ulimit».
 #
 #   Important for patching:
 #
 #   (2) This script targets any POSIX shell, so it avoids extensions provided
 #       by Bash, Ksh, etc; in particular arrays are avoided.
 #
 #       The "traditional" practice of packing multiple parameters into a
 #       space-separated string is a well documented source of bugs and security
 #       problems, so this is (mostly) avoided, by progressively accumulating
 #       options in "$@", and eventually passing that to Java.
 #
 #       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
 #       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
 #       see the in-line comments for details.
 #
 #       There are tweaks for specific operating systems such as AIX, CygWin,
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
 #       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
 #
 ##############################################################################
 # Attempt to set APP_HOME
 # Resolve links: $0 may be a link
 app_path=$0
 # Need this for daisy-chained symlinks.
 while
    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
    [ -h "$app_path" ]
 do
    ls=$( ls -ld "$app_path" )
    link=${ls#*' -> '}
    case $link in             #(
      /*)   app_path=$link ;; #(
      *)    app_path=$APP_HOME$link ;;
    esac
 done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
 # Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
 APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
 warn () {
    echo "$*"
 } >&2
 die () {
    echo
    echo "$*"
    echo
    exit 1
 } >&2
 # OS specific support (must be 'true' or 'false').
 cygwin=false
 msys=false
 darwin=false
 nonstop=false
 case "$( uname )" in                #(
  CYGWIN* )         cygwin=true  ;; #(
  Darwin* )         darwin=true  ;; #(
  MSYS* | MINGW* )  msys=true    ;; #(
  NONSTOP* )        nonstop=true ;;
 esac
 CLASSPATH="\\\"\\\""
 # Determine the Java command to use to start the JVM.
 if [ -n "$JAVA_HOME" ] ; then
    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
        # IBM's JDK on AIX uses strange locations for the executables
        JAVACMD=$JAVA_HOME/jre/sh/java
    else
        JAVACMD=$JAVA_HOME/bin/java
    fi
    if [ ! -x "$JAVACMD" ] ; then
        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
    fi
 else
    JAVACMD=java
    if ! command -v java >/dev/null 2>&1
    then
        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
    fi
 fi
 # Increase the maximum file descriptors if we can.
 if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
    case $MAX_FD in #(
      max*)
        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
        # shellcheck disable=SC2039,SC3045
        MAX_FD=$( ulimit -H -n ) ||
            warn "Could not query maximum file descriptor limit"
    esac
    case $MAX_FD in  #(
      '' | soft) :;; #(
      *)
        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
        # shellcheck disable=SC2039,SC3045
        ulimit -n "$MAX_FD" ||
            warn "Could not set maximum file descriptor limit to $MAX_FD"
    esac
 fi
 # Collect all arguments for the java command, stacking in reverse order:
 #   * args from the command line
 #   * the main class name
 #   * -classpath
 #   * -D...appname settings
 #   * --module-path (only if needed)
 #   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
 # For Cygwin or MSYS, switch paths to Windows format before running java
 if "$cygwin" || "$msys" ; then
    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
    JAVACMD=$( cygpath --unix "$JAVACMD" )
    # Now convert the arguments - kludge to limit ourselves to /bin/sh
    for arg do
        if
            case $arg in                                #(
              -*)   false ;;                            # don't mess with options #(
              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
                    [ -e "$t" ] ;;                      #(
              *)    false ;;
            esac
        then
            arg=$( cygpath --path --ignore --mixed "$arg" )
        fi
        # Roll the args list around exactly as many times as the number of
        # args, so each arg winds up back in the position where it started, but
        # possibly modified.
        #
        # NB: a `for` loop captures its iteration list before it begins, so
        # changing the positional parameters here affects neither the number of
        # iterations, nor the values presented in `arg`.
        shift                   # remove old arg
        set -- "$@" "$arg"      # push replacement arg
    done
 fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"'
 # Collect all arguments for the java command:
 #   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
 #     and any embedded shellness will be escaped.
 #   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
 #     treated as '${Hostname}' itself on the command line.
 set -- \
        "-Dorg.gradle.appname=$APP_BASE_NAME" \
        -classpath "$CLASSPATH" \
        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
        "$@"
 # Stop when "xargs" is not available.
 if ! command -v xargs >/dev/null 2>&1
 then
    die "xargs is not available"
 fi
 # Use "xargs" to parse quoted args.
 #
 # With -n1 it outputs one arg per line, with the quotes and backslashes removed.
 #
 # In Bash we could simply go:
 #
 #   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
 #   set -- "${ARGS[@]}" "$@"
 #
 # but POSIX shell has neither arrays nor command substitution, so instead we
 # post-process each arg (as a line of input to sed) to backslash-escape any
 # character that might be a shell metacharacter, then use eval to reverse
 # that process (while maintaining the separation between arguments), and wrap
 # the whole thing up as a single "set" statement.
 #
 # This will of course break if any of these variables contains a newline or
 # an unmatched quote.
 #
 eval "set -- $(
        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
        xargs -n1 |
        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
        tr '\n' ' '
    )" '"$@"'
 exec "$JAVACMD" "$@"
@@ -0,0 +1,94 @@
@rem
@rem Copyright 2015 the original author or authors.
@rem
@rem Licensed under the Apache License, Version 2.0 (the "License");
@rem you may not use this file except in compliance with the License.
@rem You may obtain a copy of the License at
@rem
@rem      https://www.apache.org/licenses/LICENSE-2.0
@rem
@rem Unless required by applicable law or agreed to in writing, software
@rem distributed under the License is distributed on an "AS IS" BASIS,
@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@rem See the License for the specific language governing permissions and
@rem limitations under the License.
@rem
@rem SPDX-License-Identifier: Apache-2.0
@rem
@if "%DEBUG%"=="" @echo off
@rem ##########################################################################
@rem
@rem  Gradle startup script for Windows
@rem
@rem ##########################################################################
@rem Set local scope for the variables with windows NT shell
 if "%OS%"=="Windows_NT" setlocal
 set DIRNAME=%~dp0
 if "%DIRNAME%"=="" set DIRNAME=.
@rem This is normally unused
 set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
@rem Resolve any "." and ".." in APP_HOME to make it shorter.
 for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 set DEFAULT_JVM_OPTS=-Dfile.encoding=UTF-8 "-Xmx64m" "-Xms64m"
@rem Find java.exe
 if defined JAVA_HOME goto findJavaFromJavaHome
 set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
 if %ERRORLEVEL% equ 0 goto execute
 echo. 1>&2
 echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
 echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 goto fail
 :findJavaFromJavaHome
 set JAVA_HOME=%JAVA_HOME:"=%
 set JAVA_EXE=%JAVA_HOME%/bin/java.exe
 if exist "%JAVA_EXE%" goto execute
 echo. 1>&2
 echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
 echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 goto fail
 :execute
@rem Setup the command line
 set CLASSPATH=
@rem Execute Gradle
 "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
 :end
@rem End local scope for the variables with windows NT shell
 if %ERRORLEVEL% equ 0 goto mainEnd
 :fail
 rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
 rem the _cmd.exe /c_ return code!
 set EXIT_CODE=%ERRORLEVEL%
 if %EXIT_CODE% equ 0 set EXIT_CODE=1
 if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
 exit /b %EXIT_CODE%
 :mainEnd
 if "%OS%"=="Windows_NT" endlocal
 :omega
@@ -1,11 +1,10 @@
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:provider/provider.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/ad_manager.dart';
-import 'package:revoltvpn/screens/settings/in_settings/haptic.dart';
+import 'package:revoltvpn/logic/haptic_settings.dart';
 class ConnectButton extends StatefulWidget {
  const ConnectButton({super.key});
@@ -15,34 +14,47 @@ class ConnectButton extends StatefulWidget {
 }
 class _ConnectButtonState extends State<ConnectButton>
-    with SingleTickerProviderStateMixin {
+    with SingleTickerProviderStateMixin, WidgetsBindingObserver {
  bool _busy = false;
-  DateTime _lastTap = DateTime.now();
+  DateTime _lastTap = DateTime.fromMillisecondsSinceEpoch(0);
  AnimationController? _pulse;
  Animation<double>? _pulseAnim;
  VpnConnection? _vpn;
  double get _pulseValue => _pulseAnim?.value ?? 0.0;
  @override
  void initState() {
    super.initState();
-    final pulse = AnimationController(vsync: this, duration: const Duration(milliseconds: 2000));
+    final pulse = AnimationController(
      vsync: this,
      duration: const Duration(milliseconds: 2000),
    );
    _pulse = pulse;
-    _pulseAnim = Tween(begin: 0.0, end: 1.0).animate(CurvedAnimation(parent: pulse, curve: Curves.easeInOut));
+    _pulseAnim = Tween(begin: 0.0, end: 1.0).animate(
      CurvedAnimation(parent: pulse, curve: Curves.easeInOut),
    );
    WidgetsBinding.instance.addObserver(this);
    WidgetsBinding.instance.addPostFrameCallback((_) {
-      context.read<VpnConnection>().addListener(_onVpnChanged);
+      if (!mounted || _vpn != null) return;
      final vpn = context.read<VpnConnection>();
      _vpn = vpn;
      vpn.addListener(_onVpnChanged);
      _onVpnChanged();
    });
  }
  @override
  void dispose() {
-    context.read<VpnConnection>().removeListener(_onVpnChanged);
+    WidgetsBinding.instance.removeObserver(this);
    _vpn?.removeListener(_onVpnChanged);
    _pulse?.dispose();
    super.dispose();
  }
  void _onVpnChanged() {
-    final vpn = context.read<VpnConnection>();
+    final vpn = _vpn;
    if (vpn == null) return;
    if (vpn.status == VpnStatus.connected) {
      _pulse?.repeat(reverse: true);
    } else {
@@ -51,8 +63,19 @@ class _ConnectButtonState extends State<ConnectButton>
    }
  }
-  Future<void> _handleTap() async {
+  @override
  void didChangeAppLifecycleState(AppLifecycleState state) {
    if (!mounted) return;
    if (state != AppLifecycleState.resumed) {
      _pulse?.stop();
      return;
    }
    if (_vpn?.status == VpnStatus.connected) {
      _pulse?.repeat(reverse: true);
    }
  }
  Future<void> _handleTap() async {
    final now = DateTime.now();
    if (now.difference(_lastTap).inMilliseconds < 1000) return;
    _lastTap = now;
@@ -61,31 +84,24 @@ class _ConnectButtonState extends State<ConnectButton>
    final timer = context.read<SessionTimer>();
    final ad = context.read<AdManager>();
    if (vpn.status == VpnStatus.connected || vpn.status == VpnStatus.connecting) {
      _busy = false;
      await timer.disconnect();
-      if (hapticEnabled) HapticFeedback.lightImpact();
+      HapticSettings.success();
      return;
    }
-
+    if (vpn.status == VpnStatus.disconnecting || _busy) return;
    if (vpn.status == VpnStatus.disconnecting) return;
    if (_busy) return;
    setState(() => _busy = true);
    try {
-      final adWatched = await ad.showAd('main');
+      final adNonce = await ad.showAd('main');
-      if (!adWatched && AdManager.adsEnabled) {
+      if (adNonce == null && AdManager.adsEnabled) return;
-        setState(() => _busy = false);
+
-        return;
+      final ok = await vpn.connect(adNonce: adNonce);
      }
      final ok = await vpn.connect();
      if (ok) {
-        timer.start();
+        await timer.start();
-        if (hapticEnabled) HapticFeedback.lightImpact();
+        HapticSettings.success();
      }
    } finally {
      if (mounted) setState(() => _busy = false);
@@ -105,15 +121,36 @@ class _ConnectButtonState extends State<ConnectButton>
          child: _pulseAnim != null
              ? AnimatedBuilder(
                  animation: _pulseAnim!,
-                  builder: (_, __) => _buildCircle(isConnected, spinning, _pulseValue),
+                  child: _buildInner(spinning),
                  builder: (_, child) =>
                      _buildCircle(isConnected, _pulseValue, child),
                )
-              : _buildCircle(isConnected, spinning, 0),
+              : _buildCircle(isConnected, 0, _buildInner(spinning)),
        );
      },
    );
  }
-  Widget _buildCircle(bool isConnected, bool spinning, double pulse) {
+  Widget _buildInner(bool spinning) {
    if (spinning) {
      return const Center(
        child: SizedBox(
          width: 36,
          height: 36,
          child: CircularProgressIndicator(
            strokeWidth: 2.5,
            color: AppColors.accent70,
          ),
        ),
      );
    }
    return Padding(
      padding: const EdgeInsets.all(14),
      child: Image.asset('assets/brand.png', fit: BoxFit.contain),
    );
  }
  Widget _buildCircle(bool isConnected, double pulse, Widget? child) {
    final glowAlpha = isConnected ? ((0.3 + pulse * 0.25) * 255).round() : 0;
    final glowRadius = isConnected ? 18.0 + (pulse * 14) : 0.0;
@@ -128,21 +165,17 @@ class _ConnectButtonState extends State<ConnectButton>
          width: isConnected ? 2.5 : 1.5,
        ),
        boxShadow: isConnected
-            ? [BoxShadow(color: Color.fromARGB(glowAlpha, 255, 214, 0), blurRadius: glowRadius, spreadRadius: glowRadius * 0.3)]
+            ? [
                BoxShadow(
                  color: Color.fromARGB(glowAlpha, 255, 214, 0),
                  blurRadius: glowRadius,
                  spreadRadius: glowRadius * 0.3,
                ),
              ]
            : [],
      ),
      clipBehavior: Clip.hardEdge,
-      child: spinning
+      child: child,
          ? const Center(
              child: SizedBox(
                width: 36, height: 36,
                child: CircularProgressIndicator(strokeWidth: 2.5, color: AppColors.accent70),
              ),
            )
          : Padding(
              padding: const EdgeInsets.all(14),
              child: Image.asset('assets/brand.png', fit: BoxFit.contain),
            ),
    );
  }
 }
@@ -19,23 +19,28 @@ class DataDisclosureDialog {
    if (!context.mounted) return;
-    await showDialog(
+    final accepted = await showDialog<bool>(
      context: context,
      barrierDismissible: false, // Must tap Continue — no tap-outside dismiss.
-      builder: (_) => _DisclosureDialog(
+      builder: (_) => const _DisclosureDialog(),
        onContinue: () {
          prefs.setBool(_key, true);
          Navigator.of(context).pop(); // Dismiss the dialog.
        },
      ),
    );
    if (accepted != true) return;
    // Persist only after the user action is complete. If storage fails, do not
    // invent an accepted state; the disclosure will simply reappear later.
    try {
      final saved = await prefs.setBool(_key, true);
      if (!saved) {
        debugPrint('[Disclosure] Preference write was rejected');
      }
    } catch (e) {
      debugPrint('[Disclosure] Failed to persist acknowledgement: $e');
    }
  }
 }
 class _DisclosureDialog extends StatelessWidget {
-  final VoidCallback onContinue;
+  const _DisclosureDialog();
  const _DisclosureDialog({required this.onContinue});
  @override
  Widget build(BuildContext context) {
@@ -49,7 +54,6 @@ class _DisclosureDialog extends StatelessWidget {
          mainAxisSize: MainAxisSize.min,
          crossAxisAlignment: CrossAxisAlignment.start,
          children: [
            // Title
            const Text(
              'Before you connect',
              style: TextStyle(
@@ -59,15 +63,14 @@ class _DisclosureDialog extends StatelessWidget {
              ),
            ),
            const SizedBox(height: 16),
            // Body
            const Text(
              'Revolt VPN creates a secure VPN tunnel to protect your '
              'traffic. To enforce your data/time quota, we log your '
-              'connection duration and data usage, linked to your '
+              'connection duration and data usage, linked to a randomly '
-              'account. We do not log or monitor the content of your '
+              'generated device ID — not to your identity. We do not log '
-              'traffic. We do not share your data with third parties.'
+              'or monitor the content of your traffic. We do not share '
-              'If you have more questions, visit our website.',
+              'your data with third parties. The full policy is in the '
              'sidebar menu under "Privacy Policy".',
              style: TextStyle(
                color: AppColors.textMuted,
                fontSize: 14,
@@ -75,12 +78,10 @@ class _DisclosureDialog extends StatelessWidget {
              ),
            ),
            const SizedBox(height: 24),
            // Continue button — full-width, accent
            SizedBox(
              width: double.infinity,
              child: ElevatedButton(
-                onPressed: onContinue,
+                onPressed: () => Navigator.of(context).pop(true),
                style: ElevatedButton.styleFrom(
                  backgroundColor: AppColors.accent,
                  foregroundColor: AppColors.bgDeep,
@@ -37,11 +37,24 @@ class _LightningEffectState extends State<LightningEffect>
  void initState() {
    super.initState();
    _ctrl = AnimationController(vsync: this, duration: const Duration(milliseconds: 400));
    lightningEnabled.addListener(_onEnabledChanged);
    if (lightningEnabled.value) _scheduleNext();
  }
  void _onEnabledChanged() {
    if (lightningEnabled.value) {
      _scheduleNext();
    } else {
      _timer?.cancel();
      _ctrl.stop();
      _bolt = null;
    }
    if (mounted) setState(() {});
  }
  @override
  void dispose() {
    lightningEnabled.removeListener(_onEnabledChanged);
    _timer?.cancel();
    _ctrl.dispose();
    super.dispose();
@@ -54,13 +67,13 @@ class _LightningEffectState extends State<LightningEffect>
  }
  void _strike() {
-    if (!mounted) return;
+    if (!mounted || !lightningEnabled.value) return;
    _bolt = LightningBolt.random(_random);
    _ctrl.forward(from: 0.0);
    if (_random.nextDouble() < widget.doubleChance) {
      Future.delayed(const Duration(milliseconds: 120), () {
-        if (mounted) {
+        if (mounted && lightningEnabled.value) {
          _bolt = LightningBolt.random(_random);
          _ctrl.forward(from: 0.0);
        }
@@ -78,7 +91,7 @@ class _LightningEffectState extends State<LightningEffect>
  @override
  Widget build(BuildContext context) {
-    if (!lightningEnabled) return const SizedBox.shrink();
+    if (!lightningEnabled.value) return const SizedBox.shrink();
    return AnimatedBuilder(
      animation: _ctrl,
      builder: (_, child) {
@@ -169,7 +182,7 @@ class _LightningPainter extends CustomPainter {
  @override
  void paint(Canvas canvas, Size size) {
-    final toScreen = (Offset p) => Offset(p.dx * size.width, p.dy * size.height);
+    Offset toScreen(Offset p) => Offset(p.dx * size.width, p.dy * size.height);
    final scaledMain = bolt.mainPath.map(toScreen).toList();
    final scaledBranches = bolt.branches
        .map((b) => b.map(toScreen).toList())
@@ -1,93 +0,0 @@
 import 'dart:io';
 import 'dart:ui' as ui;
 import 'package:flutter_local_notifications/flutter_local_notifications.dart';
 class VpnNotificationManager {
  static final FlutterLocalNotificationsPlugin _plugin =
      FlutterLocalNotificationsPlugin();
  static bool _initialized = false;
  static String? _lastTimeLeft;
  static String? _lastSpeedKbps;
  // Android channels are immutable — bump this if settings change.
  static const _channelId = 'revolt_vpn_v4';
  static const _channelName = 'Revolt VPN';
  static const _notifId = 888;
  static Future<void> init() async {
    if (_initialized) return;
    const androidSettings =
        AndroidInitializationSettings('@drawable/notification_icon');
    const initSettings = InitializationSettings(android: androidSettings);
    await _plugin.initialize(initSettings);
    if (Platform.isAndroid) {
      final androidPlugin = _plugin
          .resolvePlatformSpecificImplementation<
              AndroidFlutterLocalNotificationsPlugin>();
      await androidPlugin?.requestNotificationsPermission();
    }
    _initialized = true;
  }
  static Future<void> showOrUpdateStatus({
    required String timeLeft,
    required String speedKbps,
  }) async {
    if (timeLeft == _lastTimeLeft && speedKbps == _lastSpeedKbps) return;
    _lastTimeLeft = timeLeft;
    _lastSpeedKbps = speedKbps;
    if (!_initialized) await init();
    final bodyText = 'Time: $timeLeft  •  $speedKbps';
    final bigPictureStyle = BigPictureStyleInformation(
      const DrawableResourceAndroidBitmap('notification_banner'),
      largeIcon: const DrawableResourceAndroidBitmap('notification_icon'),
      contentTitle: 'Revolt VPN',
      summaryText: bodyText,
      htmlFormatContentTitle: false,
      htmlFormatSummaryText: false,
    );
    final androidDetails = AndroidNotificationDetails(
      _channelId,
      _channelName,
      channelDescription: 'Session timer and speed',
      importance: Importance.low,
      priority: Priority.low,
      ongoing: true,
      autoCancel: false,
      playSound: false,
      enableVibration: false,
      showWhen: false,
      visibility: NotificationVisibility.public,
      usesChronometer: false,
      category: AndroidNotificationCategory.service,
      colorized: true,
      color: const ui.Color(0xFF0D1117),
      styleInformation: bigPictureStyle,
    );
    final details = NotificationDetails(android: androidDetails);
    try {
      await _plugin.show(_notifId, _channelName, bodyText, details);
    } catch (e) {
      _initialized = false;
      try {
        await init();
        await _plugin.show(_notifId, _channelName, bodyText, details);
      } catch (_) {}
    }
  }
  static Future<void> cancel() async {
    if (!_initialized) return;
    await _plugin.cancel(_notifId);
  }
 }
@@ -36,6 +36,7 @@ class _RainEffectState extends State<RainEffect>
  late final Ticker _ticker;
  final _drops = <_Drop>[];
  final _random = Random();
  final _repaint = ValueNotifier<int>(0);
  Duration _last = Duration.zero;
  // Lifecycle
@@ -44,17 +45,33 @@ class _RainEffectState extends State<RainEffect>
  void initState() {
    super.initState();
    for (int i = 0; i < widget.dropCount; i++) {
-      _drops.add(_Drop.spawn(_random, widget.minLength, widget.maxLength));
+      _drops.add(
          _Drop.spawn(_random, widget.minLength, widget.maxLength, widget.color));
    }
-    _ticker = createTicker(_onTick)..start();
+    _ticker = createTicker(_onTick);
    rainEnabled.addListener(_onEnabledChanged);
    if (rainEnabled.value) _ticker.start();
  }
  @override
  void dispose() {
    rainEnabled.removeListener(_onEnabledChanged);
    _ticker.dispose();
    _repaint.dispose();
    super.dispose();
  }
  void _onEnabledChanged() {
    if (rainEnabled.value) {
      // Ticker elapsed restarts at zero; a stale _last makes the first dt negative.
      _last = Duration.zero;
      _ticker.start();
    } else {
      _ticker.stop();
    }
    if (mounted) setState(() {});
  }
  // Tick
  void _onTick(Duration now) {
@@ -68,23 +85,23 @@ class _RainEffectState extends State<RainEffect>
    for (final d in _drops) {
      d.y += d.speed * dt;
      if (d.y > 1.08) {
-        d.spawn(_random, widget.minLength, widget.maxLength);
+        d.spawn(_random, widget.minLength, widget.maxLength, widget.color);
        d.y = -0.06 - _random.nextDouble() * 0.08;
      }
    }
-    setState(() {}); 
+    _repaint.value++;
  }
  // Build
  @override
  Widget build(BuildContext context) {
-    if (!rainEnabled) return const SizedBox.shrink();
+    if (!rainEnabled.value) return const SizedBox.shrink();
    return CustomPaint(
      painter: _RainPainter(
        drops: _drops,
        color: widget.color,
        windDrift: widget.windDrift,
        repaint: _repaint,
      ),
      size: Size.infinite,
    );
@@ -100,33 +117,33 @@ class _Drop {
  double y;
  double speed;
  double length;
-  double opacity; 
+  Color color;
  _Drop({
    required this.x,
    required this.y,
    required this.speed,
    required this.length,
-    required this.opacity,
+    required this.color,
  });
  /// Create a drop at a random position anywhere on screen.
-  factory _Drop.spawn(Random r, double minLen, double maxLen) {
+  factory _Drop.spawn(Random r, double minLen, double maxLen, Color base) {
    return _Drop(
      x: r.nextDouble(),
      y: r.nextDouble(),
      speed: 0.30 + r.nextDouble() * 0.55,
      length: minLen + r.nextDouble() * (maxLen - minLen),
-      opacity: 0.05 + r.nextDouble() * 0.12,
+      color: base.withAlpha(((0.05 + r.nextDouble() * 0.12) * 255).round()),
    );
  }
  /// Re-randomise all properties (call when recycling a drop to the top).
-  void spawn(Random r, double minLen, double maxLen) {
+  void spawn(Random r, double minLen, double maxLen, Color base) {
    x = r.nextDouble();
    speed = 0.30 + r.nextDouble() * 0.55;
    length = minLen + r.nextDouble() * (maxLen - minLen);
-    opacity = 0.05 + r.nextDouble() * 0.12;
+    color = base.withAlpha(((0.05 + r.nextDouble() * 0.12) * 255).round());
  }
 }
@@ -136,14 +153,13 @@ class _Drop {
 class _RainPainter extends CustomPainter {
  final List<_Drop> drops;
  final Color color;
  final double windDrift;
  _RainPainter({
    required this.drops,
    required this.color,
    required this.windDrift,
-  });
+    required Listenable repaint,
  }) : super(repaint: repaint);
  @override
  void paint(Canvas canvas, Size size) {
@@ -157,11 +173,11 @@ class _RainPainter extends CustomPainter {
      final ex = sx - windDrift; // slight leftward slant
      final ey = sy + d.length;
-      paint.color = color.withAlpha((d.opacity * 255).round());
+      paint.color = d.color;
      canvas.drawLine(Offset(sx, sy), Offset(ex, ey), paint);
    }
  }
  @override
-  bool shouldRepaint(_RainPainter old) => true; // always animating
+  bool shouldRepaint(_RainPainter old) => false; // repaint listenable drives frames
 }
@@ -14,8 +14,8 @@ class DiscordLinkButton extends StatelessWidget {
  @override
  Widget build(BuildContext context) {
-    return IconButton(
+    return const IconButton(
-      icon: const Icon(Icons.discord, color: AppColors.textWhite, size: 28),
+      icon: Icon(Icons.discord, color: AppColors.textWhite, size: 28),
      onPressed: launchDiscord,
      tooltip: 'Join Discord',
      splashRadius: 24,
@@ -76,8 +76,8 @@ class GdprButton extends StatelessWidget {
  @override
  Widget build(BuildContext context) {
-    return IconButton(
+    return const IconButton(
-      icon: const Icon(Icons.admin_panel_settings_outlined,
+      icon: Icon(Icons.admin_panel_settings_outlined,
          color: AppColors.textWhite, size: 28),
      onPressed: showConsentForm,
      tooltip: 'Ad consent & privacy choices',
@@ -14,8 +14,8 @@ class InfoButton extends StatelessWidget {
  @override
  Widget build(BuildContext context) {
-    return IconButton(
+    return const IconButton(
-      icon: const Icon(Icons.help_outline, color: AppColors.textWhite, size: 28),
+      icon: Icon(Icons.help_outline, color: AppColors.textWhite, size: 28),
      onPressed: launchGitHub,
      tooltip: 'About ReVoltVPN',
      splashRadius: 24,
@@ -14,8 +14,8 @@ class PrivacyPolicyButton extends StatelessWidget {
  @override
  Widget build(BuildContext context) {
-    return IconButton(
+    return const IconButton(
-      icon: const Icon(Icons.privacy_tip_outlined, color: AppColors.textWhite, size: 28),
+      icon: Icon(Icons.privacy_tip_outlined, color: AppColors.textWhite, size: 28),
      onPressed: launchPrivacyPolicy,
      tooltip: 'Privacy Policy',
      splashRadius: 24,
@@ -12,9 +12,7 @@ class SettingsButton extends StatelessWidget {
  // Opens the settings page sliding in from the right — matches the
  // sidebar end-drawer animation so it feels like one continuous motion.
-  static void open(BuildContext context) {
+  static PageRoute<void> _route() => PageRouteBuilder<void>(
    Navigator.of(context).push(
      PageRouteBuilder(
        transitionDuration: const Duration(milliseconds: 300),
        reverseTransitionDuration: const Duration(milliseconds: 250),
        pageBuilder: (_, __, ___) => const SettingsScreen(),
@@ -23,15 +21,21 @@ class SettingsButton extends StatelessWidget {
            position: Tween<Offset>(
              begin: const Offset(1.0, 0.0),
              end: Offset.zero,
-            ).animate(CurvedAnimation(
+            ).animate(
-              parent: animation,
+              CurvedAnimation(parent: animation, curve: Curves.easeOut),
-              curve: Curves.easeOut,
+            ),
            )),
            child: child,
          );
        },
      ),
      );
  static void openWithNavigator(NavigatorState navigator) {
    if (!navigator.mounted) return;
    navigator.push(_route());
  }
  static void open(BuildContext context) {
    openWithNavigator(Navigator.of(context, rootNavigator: true));
  }
  @override
@@ -14,8 +14,8 @@ class WebsiteButton extends StatelessWidget {
  @override
  Widget build(BuildContext context) {
-    return IconButton(
+    return const IconButton(
-      icon: const Icon(Icons.language, color: AppColors.textWhite, size: 28),
+      icon: Icon(Icons.language, color: AppColors.textWhite, size: 28),
      onPressed: launchWebsite,
      tooltip: 'Website',
      splashRadius: 24,
@@ -1,3 +1,4 @@
 import 'dart:async';
 import 'package:flutter/material.dart';
 import 'package:package_info_plus/package_info_plus.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
@@ -126,8 +127,9 @@ class _SidebarDrawerState extends State<SidebarDrawer> {
              icon: Icons.settings,
              label: 'Settings',
              onTap: () {
                final navigator = Navigator.of(context, rootNavigator: true);
                Navigator.of(context).pop();
-                SettingsButton.open(context);
+                SettingsButton.openWithNavigator(navigator);
              },
            ),
@@ -135,8 +137,15 @@ class _SidebarDrawerState extends State<SidebarDrawer> {
              icon: Icons.system_update_alt,
              label: 'Check for updates',
              onTap: () {
                final navigator = Navigator.of(context, rootNavigator: true);
                final messenger = ScaffoldMessenger.of(context);
                Navigator.of(context).pop();
-                Updater.check(context);
+                unawaited(
                  Updater.checkWithHandles(
                    navigator: navigator,
                    messenger: messenger,
                  ),
                );
              },
            ),
@@ -8,10 +8,11 @@ class SpeedBox extends StatelessWidget {
  @override
  Widget build(BuildContext context) {
-    return Consumer<SessionTimer>(
+    return Selector<SessionTimer, double>(
-      builder: (context, timer, _) {
+      selector: (_, timer) => timer.currentSpeedKBps,
-        final speed = timer.currentSpeedKBps > 0.5
+      builder: (context, speedKBps, _) {
-            ? '${timer.currentSpeedKBps.toStringAsFixed(1)} KB/s'
+        final speed = speedKBps > 0.5
            ? '${speedKBps.toStringAsFixed(1)} KB/s'
            : 'Idle';
        return Container(
@@ -1,21 +1,44 @@
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/server_list.dart';
 import 'package:revoltvpn/components/online_dot.dart';
-import 'package:revoltvpn/screens/server_selector/selection_screen.dart';
+import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
-// ── lib/components/status_bar.dart ──────────────────────────────────────────
+// The one line worth showing right now, and whether it is a problem.
-// Two-card layout at the bottom of the main screen.
+class _StatusDetail {
-//
+  const _StatusDetail(this.text, {this.isProblem = false});
-// Top card:   server location from ServerList provider (flag + city).
+
-//             Tappable → opens server selector. Always visible.
+  final String text;
-// Bottom card: connection status (health dot + label + lock icon).
+  final bool isProblem;
-//
+}
-// Separated into two rows — no more RenderFlex overflow and ready for
+
-// multi-server picker.
+_StatusDetail? _detail(VpnConnection vpn, SessionTimer timer) {
  final error = vpn.errorMessage;
  if (error != null && error.isNotEmpty) {
    return _StatusDetail(error.replaceAll('\n', ' '), isProblem: true);
  }
  if (vpn.status == VpnStatus.connecting ||
      vpn.status == VpnStatus.disconnecting) {
    return _StatusDetail(vpn.statusMessage);
  }
  // Control plane only - the tunnel still carries traffic.
  if (vpn.status == VpnStatus.connected && timer.serverUnreachable) {
    return const _StatusDetail(
      'Can\'t reach the server — still connected',
      isProblem: true,
    );
  }
  if (vpn.status != VpnStatus.connected) {
    final ended = timer.lastEndMessage;
    if (ended != null) return _StatusDetail(ended, isProblem: true);
  }
  return null;
 }
 class StatusBar extends StatelessWidget {
  const StatusBar({super.key});
@@ -26,47 +49,23 @@ class StatusBar extends StatelessWidget {
      builder: (context, vpn, timer, _) {
        final isConnected = vpn.status == VpnStatus.connected;
        final isConnecting = vpn.status == VpnStatus.connecting;
-        final serverHealthy =
+        // Rule 60: reachability is known only from a session sync that
-            vpn.serverReachable || (isConnected && timer.hasSyncedOnce);
+        // succeeded, never from a probe. While disconnected the app knows
        // nothing about the server, so it claims nothing either way.
        final serverHealthy = isConnected && timer.hasSyncedOnce;
        final statusLabel = isConnected
            ? (timer.hasSyncedOnce ? 'Online' : 'Syncing…')
-            : (isConnecting
+            : (isConnecting ? 'Connecting…' : 'Ready');
                ? 'Connecting…'
                : (vpn.serverReachable ? 'Ready' : 'Offline'));
-        // Read from the ServerList provider — the source of truth for
+        final detail = _detail(vpn, timer);
        // which server is selected and what it looks like.
        final server = context.watch<ServerList>().selected;
        return Padding(
          padding: const EdgeInsets.symmetric(horizontal: 24),
          child: Column(
            mainAxisSize: MainAxisSize.min,
            children: [
-              // ── Server location ──────────────────────────────────────────
+              Container(
              GestureDetector(
                onTap: () {
                  Navigator.of(context).push(
                    PageRouteBuilder(
                      transitionDuration: const Duration(milliseconds: 300),
                      pageBuilder: (_, __, ___) => const SelectionScreen(),
                      transitionsBuilder: (_, animation, __, child) {
                        return SlideTransition(
                          position: Tween<Offset>(
                            begin: const Offset(1.0, 0.0),
                            end: Offset.zero,
                          ).animate(CurvedAnimation(
                            parent: animation,
                            curve: Curves.easeOut,
                          )),
                          child: child,
                        );
                      },
                    ),
                  );
                },
                child: Container(
                padding:
                    const EdgeInsets.symmetric(horizontal: 20, vertical: 12),
                decoration: BoxDecoration(
@@ -76,27 +75,27 @@ class StatusBar extends StatelessWidget {
                ),
                child: Row(
                  children: [
-                      Image.asset(server.flagAsset, width: 20, height: 20),
+                    Image.asset(
                      'assets/finland_flag_256.png',
                      width: 20,
                      height: 20,
                    ),
                    const SizedBox(width: 8),
-                      Expanded(
+                    const Expanded(
-                        child: Text(server.name,
+                      child: Text(
-                            style: const TextStyle(
+                        'Helsinki, Finland',
                        style: TextStyle(
                          color: AppColors.accent,
                          fontWeight: FontWeight.w600,
                          fontSize: 13,
                          letterSpacing: 0.5,
                            )),
                        ),
-                      const Icon(Icons.chevron_right,
+                      ),
-                          color: AppColors.textDim, size: 20),
+                    ),
                  ],
                ),
              ),
              ),
              const SizedBox(height: 8),
              // ── Connection status ────────────────────────────────────────
              Container(
                padding:
                    const EdgeInsets.symmetric(horizontal: 20, vertical: 10),
@@ -112,12 +111,42 @@ class StatusBar extends StatelessWidget {
                      label: statusLabel,
                    ),
                    const Spacer(),
                    if (vpn.networkTransport != 'unknown' &&
                        vpn.networkTransport != 'none')
                      Padding(
                        padding: const EdgeInsets.only(right: 8),
                        child: Text(
                          vpn.networkTransport,
                          style: const TextStyle(
                            color: AppColors.textDim,
                            fontSize: 11,
                          ),
                        ),
                      ),
                    if (isConnected)
-                      const Icon(Icons.lock,
+                      const Icon(
-                          color: AppColors.green50, size: 14),
+                        Icons.lock,
                        color: AppColors.green50,
                        size: 14,
                      ),
                  ],
                ),
              ),
              // Errors and session-end reasons used to render nowhere.
              if (detail != null)
                Padding(
                  padding: const EdgeInsets.only(top: 6),
                  child: Text(
                    detail.text,
                    textAlign: TextAlign.center,
                    style: TextStyle(
                      color: detail.isProblem
                          ? AppColors.red
                          : AppColors.textDim,
                      fontSize: 11,
                    ),
                  ),
                ),
            ],
          ),
        );
@@ -20,13 +20,22 @@ class _SupportButtonState extends State<SupportButton> {
    final ad = context.read<AdManager>();
    final timer = context.read<SessionTimer>();
-    // Only available when there's an active session.
+    // Only available when there's an active session, once the persisted
-    if (!timer.isRunning && !timer.hasSyncedOnce) return;
+    // support state is known, and only once per client-side VPN session.
    if ((!timer.isRunning && !timer.hasSyncedOnce) ||
        !timer.supportRewardStateLoaded ||
        timer.supportRewardClaimed) {
      return;
    }
    setState(() => _busy = true);
    try {
-      await ad.showAd('support');
+      final rewarded = await ad.showAd('support') != null;
      if (rewarded) {
        await timer.markSupportRewardClaimed();
        await timer.syncNow();
      }
    } finally {
      if (mounted) setState(() => _busy = false);
    }
@@ -40,8 +49,14 @@ class _SupportButtonState extends State<SupportButton> {
          return const SizedBox.shrink();
        }
        final stateLoaded = timer.supportRewardStateLoaded;
        final claimed = timer.supportRewardClaimed;
        final disabled = !stateLoaded || claimed;
        return GestureDetector(
-          onTap: _handleTap,
+          onTap: disabled ? null : _handleTap,
          child: Opacity(
            opacity: disabled ? 0.55 : 1.0,
            child: Container(
              padding: const EdgeInsets.symmetric(horizontal: 20, vertical: 10),
              decoration: BoxDecoration(
@@ -55,7 +70,11 @@ class _SupportButtonState extends State<SupportButton> {
              child: Row(
                mainAxisSize: MainAxisSize.min,
                children: [
-                const Icon(Icons.favorite_border, color: AppColors.accent, size: 20),
+                  Icon(
                    claimed ? Icons.check_circle_outline : Icons.favorite_border,
                    color: AppColors.accent,
                    size: 20,
                  ),
                  const SizedBox(width: 8),
                  _busy
                      ? const SizedBox(
@@ -66,9 +85,13 @@ class _SupportButtonState extends State<SupportButton> {
                            color: AppColors.accent,
                          ),
                        )
-                    : const Text(
+                      : Text(
-                        'Support us \u2014 30 min!',
+                          !stateLoaded
-                        style: TextStyle(
+                              ? 'Checking support bonus…'
                              : claimed
                                  ? 'Support bonus used'
                                  : 'Support us — 30 min!',
                          style: const TextStyle(
                            color: AppColors.textWhite,
                            fontSize: 14,
                            fontWeight: FontWeight.w600,
@@ -77,6 +100,7 @@ class _SupportButtonState extends State<SupportButton> {
                ],
              ),
            ),
          ),
        );
      },
    );
@@ -1,11 +1,11 @@
 import 'dart:async';
 import 'dart:convert';
 import 'dart:math';
 import 'package:flutter/foundation.dart';
 import 'package:google_mobile_ads/google_mobile_ads.dart';
 import 'package:revoltvpn/logic/crypto_service.dart';
 import 'package:revoltvpn/logic/hivemind_service.dart';
 import 'package:revoltvpn/logic/app_config.dart';
 import 'package:revoltvpn/logic/consent_manager.dart';
 class AdManager extends ChangeNotifier {
  static const bool adsEnabled = false;
@@ -27,8 +27,29 @@ class AdManager extends ChangeNotifier {
    if (adsEnabled) preloadAd();
  }
  static Future<void>? _sdkInit;
  static Future<void> ensureSdkInitialized() {
    if (!adsEnabled) return Future.value();
    return _sdkInit ??= _initSdk();
  }
  static Future<void> _initSdk() async {
    try {
      await ConsentManager.requestConsentIfNeeded()
          .timeout(const Duration(seconds: 5));
    } catch (e) {
      debugPrint('[AdManager] Consent init skipped: $e');
    }
    try {
      await MobileAds.instance.initialize().timeout(const Duration(seconds: 5));
    } catch (e) {
      debugPrint('[AdManager] MobileAds init skipped: $e');
    }
  }
  Future<bool> preloadAd() async {
    if (!adsEnabled) return true;
    await ensureSdkInitialized();
    if (_isAdLoaded) return true;
    if (_isAdLoading) return _loadCompleter?.future ?? Future.value(false);
@@ -75,13 +96,16 @@ class AdManager extends ChangeNotifier {
  // ── Show ad (or debug bypass) ─────────────────────────────────────
-  Future<bool> showAd(String adType) async {
+  // Returns the nonce put in the SSV custom_data, null if unrewarded. connect()
-    // Debug bypass: fire fake AdMob callback so support ads work in dev.
+  // must reuse it: minting a second nonce there rejects the ad's own session.
-    // The server's ADMOB_BYPASS must be True for this to succeed.
+  Future<String?> showAd(String adType) async {
-    if (!adsEnabled && kDebugMode) {
+    if (!adsEnabled) {
      // Main connect fires its own bypass in fetchConfigDirectly (rule 87).
      if (adType != 'support' || !kDebugMode) return null;
      // Needs ADMOB_BYPASS=True server-side.
      final deviceId = await CryptoService.getDeviceId();
-      final nonce = '${Random().nextInt(0x7FFFFFFF)}-${DateTime.now().millisecondsSinceEpoch}';
+      final nonce = HivemindService.newNonce();
      HivemindService.setExpectedNonce(nonce);
      try {
        final customData = jsonEncode({
          'device_id': deviceId,
@@ -93,27 +117,24 @@ class AdManager extends ChangeNotifier {
            '?signature=test&key_id=test'
            '&custom_data=${Uri.encodeComponent(customData)}');
        await HivemindService.directGet(fakeUrl, timeout: const Duration(seconds: 8));
-        return true;
+        return nonce;
      } catch (_) {
-        return false;
+        return null;
      }
    }
-    if (!adsEnabled) return false;
+    await ensureSdkInitialized();
    if (!_isAdLoaded || _rewardedAd == null) {
      final loaded = await preloadAd();
      if (!loaded || _rewardedAd == null) {
        debugPrint('[AdManager] Cannot show ad, failed to load.');
-        return false;
+        return null;
      }
    }
    final deviceId = await CryptoService.getDeviceId();
-
+    final nonce = HivemindService.newNonce();
    final nonce = '${Random().nextInt(0x7FFFFFFF)}-${DateTime.now().millisecondsSinceEpoch}';
    HivemindService.setExpectedNonce(nonce);
    debugPrint('[AdManager] Ad nonce: $nonce');
    final ssvOptions = ServerSideVerificationOptions(
      customData: jsonEncode({
@@ -158,7 +179,7 @@ class AdManager extends ChangeNotifier {
      },
    );
-    return rewardCompleter.future;
+    return await rewardCompleter.future ? nonce : null;
  }
  @override
@@ -8,29 +8,11 @@ abstract final class AppConfig {
  // ── Server ───────────────────────────────────────────────────────────
  /// Your server's public IP.  The VPN tunnel is pinned to this.
  static const String serverIp = '0.0.0.0';  // ◄── REPLACE
-
+  static const String hivemindApiPublic = 'https://YOUR_DOMAIN/api';  // ◄── REPLACE
  /// API base — routed through the tunnel to Flask via Xray "api" outbound.
  static const String hivemindApiBase = 'http://10.254.254.1:5000/api';
  // ── Bootstrap (first-connect config fetch) ────────────────────────────
  /// Hardcoded Reality config.  App connects with this, fetches the real
  /// per-session VLESS URL through the tunnel, then reconnects.
  static String get bootstrapVlessUrl =>
      'vless://$bootstrapUuid@$serverIp:8443'
      '?security=reality&type=xhttp&path=/revolt'
      '&pbk=$realityPbk&sni=www.github.com&sid=$realitySid&fp=chrome'
      '#ReVoltVPN';
  /// Generate with `xray uuid` on the server.  Must match xray_config_reality.json.
  static const String bootstrapUuid = '00000000-0000-0000-0000-000000000000';  // ◄── REPLACE
  /// Server's Reality public key (from `xray x25519`).
  static const String realityPbk = 'REPLACE_WITH_YOUR_PUBLIC_KEY';
  /// Must be in xray_config_reality.json shortIds[].
  static const String realitySid = 'abc123';
  // ── Reality (VPN tunnel) ──────────────────────────────────────────────
  //  Credentials (public key, shortId) come from /session/status, not from
  //  here.  Only the transport parameters below are compiled in.
  /// The server picks a random SNI per session from REALITY_SNI_POOL.
  /// The client does NOT hardcode one — server is always the source of truth.
@@ -47,8 +29,8 @@ abstract final class AppConfig {
  // ── Updates ────────────────────────────────────────────────────────────
  /// Used by the updater.
  static const String applicationId = 'com.paladinvpn.app';   // ◄── REPLACE
-  static const String githubOwner   = 'YOUR_USERNAME';        // ◄── REPLACE
+  static const String githubOwner   = 'YOUR_GITHUB_USERNAME'; // ◄── REPLACE (current: 'esefxdz')
-  static const String githubRepo    = 'revoltvpn';            // ◄── REPLACE
+  static const String githubRepo    = 'YOUR_REPO_NAME';       // ◄── REPLACE (current: 'ReVoltVPN')
  /// Fallback URL if the GitHub API call fails.
  static const String githubReleasesUrl = 'https://github.com/$githubOwner/$githubRepo/releases/latest';
@@ -0,0 +1,55 @@
 import 'package:flutter/foundation.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 enum ConnectionMode { tun, proxy }
 abstract final class ConnectionSettings {
  ConnectionSettings._();
  static const String _modeKey = 'connection_mode';
  static ConnectionMode _mode = ConnectionMode.tun;
  static bool _initialized = false;
  static ConnectionMode get mode => _mode;
  static Future<void> initialize() async {
    if (_initialized) return;
    final prefs = await SharedPreferences.getInstance();
    final storedMode = prefs.getString(_modeKey);
    // Only the explicit current proxy value restores SOCKS5. Unknown and
    // obsolete values, including the pre-V3 'auto' label, fail closed to
    // full-tunnel TUN instead of silently selecting a weaker route.
    _mode = storedMode == ConnectionMode.proxy.name
        ? ConnectionMode.proxy
        : ConnectionMode.tun;
    if (storedMode != _mode.name) {
      // Best-effort. _mode is already the safe TUN default in memory, so a
      // failed write leaves nothing insecure — it only means the migration
      // is retried next launch. initialize() runs from main() before
      // runApp(), with no zone guard, so throwing here would black-screen
      // the app on the fresh-install path for no security gain.
      final migrated = await prefs.setString(_modeKey, _mode.name);
      if (!migrated) {
        debugPrint('[ConnectionSettings] Could not persist migrated mode.');
      }
    }
    _initialized = true;
  }
  static Future<bool> setMode(ConnectionMode mode) async {
    if (_initialized && _mode == mode) return true;
    final prefs = await SharedPreferences.getInstance();
    final saved = await prefs.setString(_modeKey, mode.name);
    if (!saved) return false;
    _mode = mode;
    _initialized = true;
    return true;
  }
 }
@@ -4,11 +4,17 @@ import 'package:uuid/uuid.dart';
 class CryptoService {
  static const String _deviceIdPref = 'device_uuid';
  static const _storage = FlutterSecureStorage();
  static final RegExp _uuidV4 = RegExp(
    r'^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$',
    caseSensitive: false,
  );
  /// Get or create a persistent device UUID for server-side session tracking.
  /// Corrupted or tampered storage values are replaced instead of being sent
  /// to the public API as arbitrary query data.
  static Future<String> getDeviceId() async {
    final existing = await _storage.read(key: _deviceIdPref);
-    if (existing != null) return existing;
+    if (existing != null && _uuidV4.hasMatch(existing)) return existing;
    final newId = const Uuid().v4();
    await _storage.write(key: _deviceIdPref, value: newId);
@@ -0,0 +1,72 @@
 import 'dart:async';
 import 'package:flutter/foundation.dart';
 import 'package:flutter/services.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 abstract final class HapticSettings {
  HapticSettings._();
  static const String _prefKey = 'haptic_feedback_enabled';
  static const MethodChannel _channel =
      MethodChannel('com.revoltvpn.app/haptics');
  static bool _enabled = false;
  static bool _initialized = false;
  static bool get enabled => _enabled;
  static Future<void> initialize() async {
    if (_initialized) return;
    try {
      final prefs = await SharedPreferences.getInstance();
      _enabled = prefs.getBool(_prefKey) ?? false;
    } catch (e) {
      debugPrint('[Haptics] Failed to load preference: $e');
      _enabled = false;
    } finally {
      _initialized = true;
    }
  }
  static Future<void> setEnabled(bool value) async {
    final previous = _enabled;
    _enabled = value;
    _initialized = true;
    try {
      final prefs = await SharedPreferences.getInstance();
      final saved = await prefs.setBool(_prefKey, value);
      if (!saved) throw StateError('Could not save haptic setting');
    } catch (e) {
      _enabled = previous;
      debugPrint('[Haptics] Failed to save preference: $e');
      rethrow;
    }
  }
  /// Confirmation haptic for a successful connect/disconnect. Best-effort: a
  /// vibration failure must never block or fail the VPN action.
  static void success() => unawaited(_impact());
  static Future<void> _impact() async {
    if (!_initialized) await initialize();
    if (!_enabled || kIsWeb) return;
    if (defaultTargetPlatform == TargetPlatform.android) {
      try {
        final handled = await _channel.invokeMethod<bool>(
              'impact',
              <String, Object>{'kind': 'success'},
            ) ??
            false;
        if (handled) return;
      } catch (e) {
        debugPrint('[Haptics] Native vibration unavailable: $e');
      }
    }
    await HapticFeedback.mediumImpact();
  }
 }
@@ -1,7 +1,7 @@
 import 'dart:async';
 import 'dart:convert';
 import 'dart:io';
 import 'dart:math';
 import 'package:flutter/foundation.dart';
 import 'package:http/http.dart' as http;
 import 'package:revoltvpn/logic/app_config.dart';
@@ -13,181 +13,441 @@ class HivemindService {
  static const _ua = 'Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 '
      '(KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36';
  static const int _maxControlResponseBytes = 256 * 1024;
  static const _pollBackoff = <Duration>[
    Duration(seconds: 1),
    Duration(seconds: 2),
    Duration(seconds: 3),
    Duration(seconds: 5),
  ];
-  static Future<http.Response> directGet(Uri uri, {Duration timeout = const Duration(seconds: 5)}) {
+  static Future<http.Response> directGet(
-    return http.get(uri, headers: {'User-Agent': _ua}).timeout(timeout);
+    Uri uri, {
    Duration timeout = const Duration(seconds: 5),
  }) {
    return controlGet(uri, timeout: timeout);
  }
-  static Future<http.Response> directPost(Uri uri, String body, {Duration timeout = const Duration(seconds: 5)}) {
+  static Future<http.Response> controlGet(
-    return http.post(uri, headers: {
+    Uri uri, {
-      'Content-Type': 'application/json',
+    Duration timeout = const Duration(seconds: 5),
-      'User-Agent': _ua,
+  }) async {
-    }, body: body).timeout(timeout);
+    final client = http.Client();
    final request = http.Request('GET', uri)
      ..headers['User-Agent'] = _ua
      ..followRedirects = false;
    Future<http.Response> read() async {
      final streamed = await client.send(request);
      final declaredLength = streamed.contentLength;
      if (declaredLength != null && declaredLength > _maxControlResponseBytes) {
        throw const FormatException('Control response is too large.');
      }
-  static Future<http.Response> proxyGet(Uri uri, {Duration timeout = const Duration(seconds: 5)}) {
+      final bytes = <int>[];
-    return _proxyRequest('GET', uri, timeout: timeout);
+      await for (final chunk in streamed.stream) {
        if (bytes.length + chunk.length > _maxControlResponseBytes) {
          throw const FormatException('Control response is too large.');
        }
        bytes.addAll(chunk);
      }
-  static Future<http.Response> proxyPost(Uri uri, String body, {Duration timeout = const Duration(seconds: 5)}) {
+      return http.Response.bytes(
-    return _proxyRequest('POST', uri, body: body, timeout: timeout);
+        bytes,
        streamed.statusCode,
        headers: streamed.headers,
        isRedirect: streamed.isRedirect,
        persistentConnection: streamed.persistentConnection,
        reasonPhrase: streamed.reasonPhrase,
        request: request,
      );
    }
  static Future<http.Response> _proxyRequest(String method, Uri uri,
      {String? body, Duration timeout = const Duration(seconds: 5)}) async {
    final socket = await Socket.connect('127.0.0.1', 10808, timeout: timeout);
    try {
-      final target = uri.toString();
+      return await read().timeout(
-      final headers = <String, String>{
+        timeout,
-        'Host': '${uri.host}:${uri.port}',
+        onTimeout: () {
-        'User-Agent': _ua,
+          client.close();
-        'Accept': '*/*',
+          throw TimeoutException('Control request timed out.', timeout);
-        'Connection': 'close',
+        },
-      };
+      );
-      if (body != null) {
+    } finally {
-        headers['Content-Type'] = 'application/json';
+      client.close();
-        headers['Content-Length'] = body.length.toString();
+    }
  }
-      final reqBuf = StringBuffer();
+  static Future<http.Response> controlPost(
-      reqBuf.write('$method $target HTTP/1.1\r\n');
+    Uri uri,
-      headers.forEach((k, v) => reqBuf.write('$k: $v\r\n'));
+    Map<String, dynamic> body, {
-      reqBuf.write('\r\n');
+    Duration timeout = const Duration(seconds: 5),
-      if (body != null) reqBuf.write(body);
+  }) async {
    final client = http.Client();
    final request = http.Request('POST', uri)
      ..headers['User-Agent'] = _ua
      ..headers['Content-Type'] = 'application/json'
      ..body = jsonEncode(body)
      ..followRedirects = false;
-      socket.write(reqBuf.toString());
+    Future<http.Response> send() async {
-      await socket.flush();
+      final streamed = await client.send(request);
      final declaredLength = streamed.contentLength;
      if (declaredLength != null && declaredLength > _maxControlResponseBytes) {
        throw const FormatException('Control response is too large.');
      }
-      final response = await socket.fold<String>(
+      final bytes = <int>[];
-        '',
+      await for (final chunk in streamed.stream) {
-        (prev, chunk) => prev + String.fromCharCodes(chunk),
+        if (bytes.length + chunk.length > _maxControlResponseBytes) {
-      ).timeout(timeout);
+          throw const FormatException('Control response is too large.');
        }
        bytes.addAll(chunk);
      }
-      final parts = response.split('\r\n\r\n');
+      return http.Response.bytes(bytes, streamed.statusCode,
-      if (parts.length < 2) throw Exception('Invalid proxy response');
+          headers: streamed.headers, request: request);
-      final headerBlock = parts[0];
+    }
      final respBody = parts.sublist(1).join('\r\n\r\n');
-      final headerLines = headerBlock.split('\r\n');
+    try {
-      final statusParts = headerLines[0].split(' ');
+      return await send().timeout(
-      final statusCode = int.parse(statusParts[1]);
+        timeout,
-
+        onTimeout: () {
-      return http.Response(respBody, statusCode);
+          client.close();
          throw TimeoutException('Control request timed out.', timeout);
        },
      );
    } finally {
-      socket.destroy();
+      client.close();
    }
  }
  // Hands the session back so the server can drop the VLESS client instead of
  // leaving it provisioned until the window runs out.
  //
  // Only the user-initiated disconnect calls this. An expiry, a hard cap or a
  // server-ended session is already gone server-side, and /session/stop takes
  // nothing but a device_id as proof (hivemind/api.py notes this), so a
  // transient client error must never be allowed to destroy a live session.
  // Best effort throughout: the session expires on its own regardless.
  static Future<void> releaseSession() async {
    try {
      final deviceId = await CryptoService.getDeviceId();
      await controlPost(
        _publicUrl('/session/stop'),
        {'device_id': deviceId},
        timeout: const Duration(seconds: 3),
      );
    } catch (_) {
      // Nothing to recover: the server expires the session anyway.
    }
  }
  static void cancel() {
    _currentCallId++;
    _expectedNonce = null;
  }
-  static void setExpectedNonce(String nonce) {
+  // Fetches this device's VLESS URL. Every session starts the same way, so
-    _expectedNonce = nonce;
+  // there is always a nonce to bind it to: either the one the ad minted, or one
-  }
+  // we mint here before firing the bypass (rule 87). The re-attach path that
-
+  // used to accept any nonce is gone - see rule 4.
  static Future<String> fetchConfigDirectly({
    void Function(int attempt, int total)? onAttempt,
-    bool skipAdBypass = false,
+    String? adNonce,
  }) async {
-    final deviceId = await CryptoService.getDeviceId();
+    // Capture the generation before the first await. Otherwise a disconnect
-
+    // that lands while secure storage is resolving the device ID can be lost
    // and the cancelled call can resume network work with a fresh generation.
    final callId = ++_currentCallId;
-    final nonce = '${Random().nextInt(0x7FFFFFFF)}-${DateTime.now().millisecondsSinceEpoch}';
+    final deviceId = await CryptoService.getDeviceId();
    _throwIfCancelled(callId);
    final nonce = adNonce ?? newNonce();
    _expectedNonce = nonce;
    debugPrint('[HivemindService] Call #$callId — nonce: $nonce');
-    final url = _publicUrl('/session/status?device_id=$deviceId');
+    if (adNonce == null) {
-
+      await _runConfiguredBypass(deviceId, nonce);
-    if (!skipAdBypass) {
+      _throwIfCancelled(callId);
      try {
        final customData = jsonEncode({'device_id': deviceId, 'nonce': nonce});
        final fakeUrl = _publicUrl(
            '/admob/callback?signature=test&key_id=test&custom_data=${Uri.encodeComponent(customData)}');
        await directGet(fakeUrl, timeout: const Duration(seconds: 8));
      } catch (_) {}
    }
-    const maxAttempts = 5;
+    final maxAttempts = adNonce != null ? 10 : 5;
-    for (int i = 1; i <= maxAttempts; i++) {
+    for (var attempt = 1; attempt <= maxAttempts; attempt++) {
-      if (_currentCallId != callId) throw Exception('Cancelled');
+      _throwIfCancelled(callId);
      onAttempt?.call(attempt, maxAttempts);
      onAttempt?.call(i, maxAttempts);
      try {
-        final response = await directGet(url);
+        final session = await _fetchActiveSession(deviceId, nonce);
-        if (response.statusCode == 200) {
+        _throwIfCancelled(callId);
-          final data = jsonDecode(response.body);
+        if (session != null) {
          final serverNonce = data['nonce'] as String?;
          if (_expectedNonce != null && serverNonce != null && serverNonce != _expectedNonce) {
            debugPrint('[HivemindService] Nonce mismatch — retrying…');
          } else if (data['active'] == true && data['vless_uuid'] != null) {
            final vlessUuid = data['vless_uuid'];
            final vlessIp   = data['vless_ip'] ?? AppConfig.serverIp;
            final vlessPort = data['vless_port'] ?? 443;
            final pbk       = data['reality_pbk'] ?? '';
            final sid       = data['reality_sid'] ?? '';
            final sni       = data['reality_sni'];
            if (sni == null) throw Exception('Server did not provide reality_sni');
            final fp        = data['reality_fp']  ?? AppConfig.realityFp;
            final xhttpPath = data['xhttp_path']  ?? AppConfig.vlessPath;
            final vlessUrl = 'vless://$vlessUuid@$vlessIp:$vlessPort'
                '?security=${AppConfig.vlessSecurity}'
                '&type=${AppConfig.vlessType}'
                '&path=$xhttpPath'
                '&pbk=${Uri.encodeComponent(pbk)}'
                '&sni=${Uri.encodeComponent(sni)}'
                '&sid=${Uri.encodeComponent(sid)}'
                '&fp=${Uri.encodeComponent(fp)}'
                '#Revolt VPN';
          _expectedNonce = null;
-            return vlessUrl;
+          return session.toVlessUrl();
          }
        }
      } catch (e) {
-        if (e.toString().contains('Cancelled')) rethrow;
+        if (_isCancelledError(e)) rethrow;
-        debugPrint('[HivemindService] Attempt $i failed: $e');
+        debugPrint('[Hivemind] session attempt $attempt failed');
      }
-      if (i < maxAttempts) await Future.delayed(const Duration(seconds: 1));
+      if (attempt < maxAttempts) {
        await Future.delayed(
          _pollBackoff[min(attempt - 1, _pollBackoff.length - 1)],
        );
        _throwIfCancelled(callId);
      }
    }
    throw Exception('Session not activated. Server callback may have timed out.');
  }
-  static Future<bool> checkHealth() async {
+  static String newNonce() {
    final random = Random.secure();
    final high = random.nextInt(0x7FFFFFFF);
    final low = random.nextInt(0x7FFFFFFF);
    return '$high-$low-${DateTime.now().microsecondsSinceEpoch}';
  }
  static Future<void> _runConfiguredBypass(String deviceId, String nonce) async {
    try {
-      final url = Uri.parse('${AppConfig.hivemindApiPublic}/health');
+      final customData = jsonEncode({'device_id': deviceId, 'nonce': nonce});
-      final response = await directGet(url, timeout: const Duration(seconds: 3));
+      final callback = _publicUrl(
-      return response.statusCode == 200;
+        '/admob/callback?signature=test&key_id=test&custom_data=${Uri.encodeComponent(customData)}',
      );
      await directGet(callback, timeout: const Duration(seconds: 8));
    } catch (_) {
-      return false;
+      // Validation bypass behavior is intentionally best-effort in this build.
    }
  }
-  static Future<bool> verifySession() async {
+  static Future<_HivemindSessionConfig?> _fetchActiveSession(
-    try {
+    String deviceId,
-      final deviceId = await CryptoService.getDeviceId();
+    String nonce,
-      final url = _tunnelUrl('/session/status?device_id=$deviceId');
+  ) async {
-      final response = await proxyGet(url);
+    final statusUri = _publicUrl('/session/status').replace(
-      if (response.statusCode == 200) {
+      queryParameters: {'device_id': deviceId},
-        final data = jsonDecode(response.body);
+    );
-        return data['active'] == true;
+    final response = await controlGet(statusUri);
-      }
+    if (response.statusCode != 200) return null;
-    } catch (_) {}
+
-    return false;
+    final decoded = jsonDecode(response.body);
    if (decoded is! Map<String, dynamic>) return null;
    final serverNonce = decoded['nonce'];
    if (_expectedNonce != nonce) return null;
    if (serverNonce is! String || serverNonce != nonce) return null;
    if (decoded['active'] != true || decoded['vless_uuid'] == null) {
      return null;
    }
-  // Idle sessions are culled server-side by the management loop
+    return _HivemindSessionConfig.fromJson(decoded);
-  // after 2 minutes of no /status polls (user disconnected).
+  }
  static void disconnectAndCleanup() {}
-  // ── URL builders ──────────────────────────────────────────────────
+  static void _throwIfCancelled(int callId) {
    if (_currentCallId != callId) throw Exception('Cancelled');
  }
  static bool _isCancelledError(Object error) =>
      error.toString().contains('Cancelled');
  static Uri _publicUrl(String path) =>
      Uri.parse('${AppConfig.hivemindApiPublic}$path');
 }
-  static Uri _tunnelUrl(String path) =>
+class _HivemindSessionConfig {
-      Uri.parse('${AppConfig.hivemindApiBase}$path');
+  static final RegExp _uuidPattern = RegExp(
    r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$',
    caseSensitive: false,
  );
  static final RegExp _shortIdPattern =
      RegExp(r'^[0-9a-f]{0,16}$', caseSensitive: false);
  final String uuid;
  final String host;
  final int port;
  final String publicKey;
  final String shortId;
  final String sni;
  final String fingerprint;
  final String path;
  const _HivemindSessionConfig({
    required this.uuid,
    required this.host,
    required this.port,
    required this.publicKey,
    required this.shortId,
    required this.sni,
    required this.fingerprint,
    required this.path,
  });
  factory _HivemindSessionConfig.fromJson(Map<String, dynamic> json) {
    final uuid = _requiredString(json, 'vless_uuid', maxLength: 64);
    if (!_uuidPattern.hasMatch(uuid)) {
      throw const FormatException('Invalid VLESS UUID');
    }
    // The API may rotate credentials and Reality parameters, but it must never
    // choose the tunnel destination. Keep that trust anchor compiled into the
    // app so an API/domain compromise can cause denial of service, not redirect
    // VPN traffic to an attacker-controlled server.
    final pinnedHost = _validatedPublicIp(AppConfig.serverIp, 'serverIp');
    final advertisedHost = json['vless_ip'];
    if (advertisedHost != null) {
      if (advertisedHost is! String || advertisedHost.trim() != pinnedHost) {
        throw const FormatException(
          'Session VLESS host does not match compiled server pin',
        );
      }
    }
    final host = pinnedHost;
    final advertisedPort = json['vless_port'];
    if (advertisedPort != null &&
        (advertisedPort is! num || advertisedPort.toInt() != 443)) {
      throw const FormatException('Session VLESS port does not match compiled pin');
    }
    const port = 443;
    final sni = _validatedHost(
      _requiredString(json, 'reality_sni', maxLength: 253),
      'reality_sni',
    );
    final publicKey = _requiredString(json, 'reality_pbk', maxLength: 128);
    final shortId = _stringOr(json['reality_sid'], '').trim();
    if (!_shortIdPattern.hasMatch(shortId)) {
      throw const FormatException('Invalid Reality short ID');
    }
    final fingerprint =
        _boundedString(json['reality_fp'], AppConfig.realityFp, 32, 'reality_fp');
    final path =
        _boundedString(json['xhttp_path'], AppConfig.vlessPath, 2048, 'xhttp_path');
    if (!path.startsWith('/')) {
      throw const FormatException('Invalid XHTTP path');
    }
    return _HivemindSessionConfig(
      uuid: uuid,
      host: host,
      port: port,
      publicKey: publicKey,
      shortId: shortId,
      sni: sni,
      fingerprint: fingerprint,
      path: path,
    );
  }
  String toVlessUrl() {
    return Uri(
      scheme: 'vless',
      userInfo: uuid,
      host: host,
      port: port,
      queryParameters: <String, String>{
        'security': AppConfig.vlessSecurity,
        'type': AppConfig.vlessType,
        'path': path,
        'pbk': publicKey,
        'sni': sni,
        'sid': shortId,
        'fp': fingerprint,
      },
      fragment: 'Revolt VPN',
    ).toString();
  }
  static String _requiredString(
    Map<String, dynamic> json,
    String key, {
    int maxLength = 4096,
  }) {
    final value = json[key];
    if (value is! String) {
      throw FormatException('Missing required session field: $key');
    }
    final trimmed = value.trim();
    if (trimmed.isEmpty || trimmed.length > maxLength) {
      throw FormatException('Invalid session field: $key');
    }
    return trimmed;
  }
  static String _stringOr(Object? value, String fallback) {
    return value is String && value.trim().isNotEmpty ? value.trim() : fallback;
  }
  static String _boundedString(
    Object? value,
    String fallback,
    int maxLength,
    String field,
  ) {
    final result = _stringOr(value, fallback);
    if (result.isEmpty || result.length > maxLength) {
      throw FormatException('Invalid session field: $field');
    }
    return result;
  }
  static String _validatedHost(String input, String field) {
    final value = input.trim();
    if (value.isEmpty ||
        value.length > 253 ||
        value.contains(RegExp(r'[\s/@?#]'))) {
      throw FormatException('Invalid session host: $field');
    }
    try {
      final probe = Uri(scheme: 'https', host: value);
      if (probe.host.isEmpty) {
        throw FormatException('Invalid session host: $field');
      }
    } on FormatException {
      throw FormatException('Invalid session host: $field');
    }
    return value;
  }
  static String _validatedPublicIp(String input, String field) {
    final value = input.trim().toLowerCase();
    if (_isPublicIpv4(value) || _isPublicIpv6(value)) return value;
    throw FormatException('Invalid public IP pin: $field');
  }
  static bool _isPublicIpv4(String value) {
    final parts = value.split('.');
    if (parts.length != 4) return false;
    final octets = <int>[];
    for (final part in parts) {
      if (part.isEmpty || (part.length > 1 && part.startsWith('0'))) return false;
      final parsed = int.tryParse(part);
      if (parsed == null || parsed < 0 || parsed > 255) return false;
      octets.add(parsed);
    }
    final a = octets[0];
    final b = octets[1];
    if (a == 0 || a == 10 || a == 127 || a >= 224) return false;
    if (a == 100 && b >= 64 && b <= 127) return false;
    if (a == 169 && b == 254) return false;
    if (a == 172 && b >= 16 && b <= 31) return false;
    if (a == 192 && b == 168) return false;
    if (a == 192 && b == 0 && octets[2] == 2) return false;
    if (a == 198 && b == 51 && octets[2] == 100) return false;
    if (a == 203 && b == 0 && octets[2] == 113) return false;
    return true;
  }
  static bool _isPublicIpv6(String value) {
    if (!value.contains(':') || value.contains('.')) return false;
    try {
      final parsed = Uri.parse('https://[$value]/');
      if (parsed.host.isEmpty || !parsed.host.contains(':')) return false;
    } on FormatException {
      return false;
    }
    if (value == '::' || value == '::1') return false;
    if (value.startsWith('fc') || value.startsWith('fd')) return false;
    if (value.startsWith('fe8') || value.startsWith('fe9') || value.startsWith('fea') || value.startsWith('feb')) return false;
    if (value.startsWith('ff')) return false;
    if (value.startsWith('2001:db8:') || value == '2001:db8::') return false;
    return true;
  }
 }
@@ -0,0 +1,342 @@
 import 'dart:async';
 import 'dart:convert';
 import 'dart:io';
 import 'dart:typed_data';
 class LocalSocksTestResult {
  final bool ok;
  final int? latencyMs;
  final String message;
  const LocalSocksTestResult({
    required this.ok,
    required this.latencyMs,
    required this.message,
  });
 }
 abstract final class LocalSocksTester {
  LocalSocksTester._();
  /// Fast local readiness probe used while starting the VPN.
  ///
  /// This stops after authenticated SOCKS5 negotiation. Startup must not depend
  /// on an unrelated external host being reachable.
  static Future<LocalSocksTestResult> testListener({
    String host = '127.0.0.1',
    required int port,
    required String username,
    required String password,
  }) async {
    final stopwatch = Stopwatch()..start();
    Socket? socket;
    _SocketReader? reader;
    try {
      socket = await Socket.connect(
        host,
        port,
        timeout: const Duration(seconds: 1),
      );
      socket.setOption(SocketOption.tcpNoDelay, true);
      reader = _SocketReader(socket);
      final authenticated = await _authenticate(
        reader,
        socket,
        username: username,
        password: password,
        timeout: const Duration(seconds: 1),
      );
      if (!authenticated) {
        return const LocalSocksTestResult(
          ok: false,
          latencyMs: null,
          message: 'Local SOCKS5 listener rejected authentication.',
        );
      }
      stopwatch.stop();
      return LocalSocksTestResult(
        ok: true,
        latencyMs: stopwatch.elapsedMilliseconds,
        message: 'Local SOCKS5 listener is ready.',
      );
    } on TimeoutException {
      return const LocalSocksTestResult(
        ok: false,
        latencyMs: null,
        message: 'Local SOCKS5 listener timed out.',
      );
    } on SocketException {
      return LocalSocksTestResult(
        ok: false,
        latencyMs: null,
        message: 'Local SOCKS5 is not listening on $host:$port.',
      );
    } catch (_) {
      return const LocalSocksTestResult(
        ok: false,
        latencyMs: null,
        message: 'Local SOCKS5 listener check failed.',
      );
    } finally {
      await reader?.close();
      await socket?.close();
    }
  }
  /// Full user-facing test: authenticated local SOCKS handshake, an outbound
  /// CONNECT through the active ReVolt route, and — critically — a real
  /// request/response exchange over that CONNECT.
  ///
  /// The exchange is not optional politeness. Xray answers a SOCKS CONNECT
  /// before it dials upstream, so the reply code alone says nothing about the
  /// outbound: it returns success for unroutable addresses and for hostnames
  /// that can never resolve. Without a round trip this test reports OK while
  /// the server is down, which is precisely when a user runs it.
  static Future<LocalSocksTestResult> test({
    String host = '127.0.0.1',
    required int port,
    required String username,
    required String password,
    String targetHost = 'example.com',
    int targetPort = 80,
  }) async {
    const totalTimeout = Duration(seconds: 8);
    final stopwatch = Stopwatch()..start();
    Socket? socket;
    _SocketReader? reader;
    Duration remaining() {
      final micros = totalTimeout.inMicroseconds - stopwatch.elapsedMicroseconds;
      if (micros <= 0) throw TimeoutException('SOCKS5 test timed out.', totalTimeout);
      return Duration(microseconds: micros);
    }
    try {
      if (targetPort <= 0 || targetPort > 65535) {
        return const LocalSocksTestResult(
          ok: false,
          latencyMs: null,
          message: 'SOCKS5 test target is invalid.',
        );
      }
      socket = await Socket.connect(
        host,
        port,
        timeout: remaining(),
      );
      socket.setOption(SocketOption.tcpNoDelay, true);
      reader = _SocketReader(socket);
      final authenticated = await _authenticate(
        reader,
        socket,
        username: username,
        password: password,
        timeout: remaining(),
      );
      if (!authenticated) {
        return const LocalSocksTestResult(
          ok: false,
          latencyMs: null,
          message: 'Local SOCKS5 listener rejected authentication.',
        );
      }
      final hostBytes = utf8.encode(targetHost);
      if (hostBytes.isEmpty || hostBytes.length > 255) {
        return const LocalSocksTestResult(
          ok: false,
          latencyMs: null,
          message: 'SOCKS5 test target is invalid.',
        );
      }
      socket.add(<int>[
        0x05,
        0x01,
        0x00,
        0x03,
        hostBytes.length,
        ...hostBytes,
        (targetPort >> 8) & 0xff,
        targetPort & 0xff,
      ]);
      await socket.flush();
      final replyHead = await reader.readExactly(4, timeout: remaining());
      if (replyHead[0] != 0x05 || replyHead[1] != 0x00) {
        return const LocalSocksTestResult(
          ok: false,
          latencyMs: null,
          message:
              'SOCKS5 is listening, but the ReVolt route could not reach the test target.',
        );
      }
      await _consumeAddress(reader, replyHead[3], timeout: remaining());
      // The CONNECT reply above is not evidence of an outbound. Force a round
      // trip and require the peer's answer before claiming the route works.
      socket.add(
        utf8.encode(
          'GET / HTTP/1.1\r\nHost: $targetHost\r\nConnection: close\r\n\r\n',
        ),
      );
      await socket.flush();
      List<int> banner;
      try {
        banner = await reader.readExactly(5, timeout: remaining());
      } on TimeoutException {
        return const LocalSocksTestResult(
          ok: false,
          latencyMs: null,
          message: 'Local SOCKS5 is up, but the ReVolt outbound never replied.',
        );
      } on SocketException {
        return const LocalSocksTestResult(
          ok: false,
          latencyMs: null,
          message:
              'Local SOCKS5 is up, but the ReVolt outbound dropped the connection.',
        );
      }
      if (String.fromCharCodes(banner) != 'HTTP/') {
        return const LocalSocksTestResult(
          ok: false,
          latencyMs: null,
          message:
              'Local SOCKS5 is up, but the ReVolt outbound returned unexpected data.',
        );
      }
      stopwatch.stop();
      return LocalSocksTestResult(
        ok: true,
        latencyMs: stopwatch.elapsedMilliseconds,
        message: 'Local SOCKS5 and the ReVolt outbound are reachable.',
      );
    } on TimeoutException {
      return const LocalSocksTestResult(
        ok: false,
        latencyMs: null,
        message: 'Local SOCKS5 test timed out.',
      );
    } on SocketException {
      return LocalSocksTestResult(
        ok: false,
        latencyMs: null,
        message: 'Local SOCKS5 is not listening on $host:$port.',
      );
    } catch (_) {
      return const LocalSocksTestResult(
        ok: false,
        latencyMs: null,
        message: 'Local SOCKS5 test failed.',
      );
    } finally {
      await reader?.close();
      await socket?.close();
    }
  }
  static Future<bool> _authenticate(
    _SocketReader reader,
    Socket socket, {
    required String username,
    required String password,
    Duration timeout = const Duration(seconds: 4),
  }) async {
    final userBytes = utf8.encode(username);
    final passBytes = utf8.encode(password);
    if (userBytes.isEmpty ||
        passBytes.isEmpty ||
        userBytes.length > 255 ||
        passBytes.length > 255) {
      return false;
    }
    // ReVolt never accepts unauthenticated local SOCKS. Advertising only RFC
    // 1929 username/password auth makes a future credential-plumbing regression
    // fail closed instead of silently falling back to method 0x00.
    socket.add(const <int>[0x05, 0x01, 0x02]);
    await socket.flush();
    final greeting = await reader.readExactly(2, timeout: timeout);
    if (greeting[0] != 0x05 || greeting[1] != 0x02) return false;
    socket.add(<int>[
      0x01,
      userBytes.length,
      ...userBytes,
      passBytes.length,
      ...passBytes,
    ]);
    await socket.flush();
    final authReply = await reader.readExactly(2, timeout: timeout);
    return authReply[0] == 0x01 && authReply[1] == 0x00;
  }
  static Future<void> _consumeAddress(
    _SocketReader reader,
    int addressType, {
    required Duration timeout,
  }) async {
    if (addressType == 0x01) {
      await reader.readExactly(4 + 2, timeout: timeout);
      return;
    }
    if (addressType == 0x04) {
      await reader.readExactly(16 + 2, timeout: timeout);
      return;
    }
    if (addressType == 0x03) {
      final length = (await reader.readExactly(1, timeout: timeout)).first;
      if (length == 0) {
        throw const FormatException('Invalid SOCKS5 domain length');
      }
      await reader.readExactly(length + 2, timeout: timeout);
      return;
    }
    throw const FormatException('Unsupported SOCKS5 address type');
  }
 }
 class _SocketReader {
  final StreamIterator<Uint8List> _iterator;
  final List<int> _buffer = <int>[];
  _SocketReader(Socket socket) : _iterator = StreamIterator<Uint8List>(socket);
  Future<List<int>> readExactly(
    int count, {
    Duration timeout = const Duration(seconds: 4),
  }) async {
    final elapsed = Stopwatch()..start();
    while (_buffer.length < count) {
      final remainingMicros = timeout.inMicroseconds - elapsed.elapsedMicroseconds;
      if (remainingMicros <= 0) {
        throw TimeoutException('Socket read timed out', timeout);
      }
      final hasNext = await _iterator.moveNext().timeout(
            Duration(microseconds: remainingMicros),
          );
      if (!hasNext) {
        throw const SocketException('Socket closed early');
      }
      _buffer.addAll(_iterator.current);
    }
    final result = _buffer.sublist(0, count);
    _buffer.removeRange(0, count);
    return result;
  }
  Future<void> close() => _iterator.cancel();
 }
@@ -0,0 +1,42 @@
 import 'package:flutter/services.dart';
 class NetworkSnapshot {
  final String reason;
  final String transport;
  final bool connected;
  final bool validated;
  final bool metered;
  final int timestamp;
  const NetworkSnapshot({
    required this.reason,
    required this.transport,
    required this.connected,
    required this.validated,
    required this.metered,
    required this.timestamp,
  });
  factory NetworkSnapshot.fromMap(Map<dynamic, dynamic> map) {
    return NetworkSnapshot(
      reason: map['reason'] as String? ?? 'changed',
      transport: map['transport'] as String? ?? 'unknown',
      connected: map['connected'] == true,
      validated: map['validated'] == true,
      metered: map['metered'] == true,
      timestamp: (map['timestamp'] as num?)?.toInt() ?? 0,
    );
  }
 }
 abstract final class NetworkMonitor {
  NetworkMonitor._();
  static const EventChannel _channel = EventChannel('com.revoltvpn.app/network');
  static Stream<NetworkSnapshot> get changes {
    return _channel.receiveBroadcastStream().where((event) => event is Map).map(
          (event) => NetworkSnapshot.fromMap(event as Map<dynamic, dynamic>),
        );
  }
 }
@@ -0,0 +1,62 @@
 import 'package:flutter/services.dart';
 // ── lib/logic/notification_service.dart ─────────────────────────────────────
 // Bridge to the native VPN notification, which flutter_vless owns. This only
 // refreshes its content text with the session countdown, so a failure here is
 // never worth propagating to the session timer.
 class NotificationService {
  NotificationService._();
  static const MethodChannel _channel =
      MethodChannel('com.revoltvpn.app/notification');
  static String? _lastText;
  /// Sets the notification's content text to [text].
  ///
  /// The native side rebuilds the whole notification, so skip the round-trip
  /// when the text has not changed. A failed native update is intentionally
  /// not cached so the next tick can retry it.
  static Future<void> updateTimer(String text) async {
    if (text == _lastText) return;
    try {
      await _channel.invokeMethod<void>('updateNotificationText', {
        'title': 'Revolt VPN',
        'text': text,
        'disconnectLabel': 'Disconnect',
      });
      _lastText = text;
    } catch (_) {
      // Cosmetic.
    }
  }
  // Same id as the service's own alert, so a double post replaces.
  static Future<void> showDisconnectedAlert() async {
    try {
      await _channel.invokeMethod<void>('showDisconnectedAlert');
    } catch (_) {
      // Informational only.
    }
  }
  /// Takes down the countdown notification.
  ///
  /// [updateTimer] re-posts an ongoing, non-dismissible notification, so a tick
  /// that lands after the VPN service has cancelled its own foreground copy
  /// leaves a frozen countdown on screen that nobody owns. Call this once the
  /// tunnel is actually down.
  static Future<void> cancelTimer() async {
    _lastText = null;
    try {
      await _channel.invokeMethod<void>('cancelNotification');
    } catch (_) {
      // Cosmetic.
    }
  }
  /// Forces the next connect to re-post even if the countdown resumes on the
  /// same value.
  static void reset() => _lastText = null;
 }
@@ -0,0 +1,44 @@
 import 'package:flutter/foundation.dart';
 import 'package:flutter/services.dart';
 /// Background-survival controls.
 ///
 /// Android stops background services of apps that are not exempt from Doze and
 /// App Standby, and it tears down the whole process group when a task is swiped
 /// away. Those are OS behaviours, not app bugs; the battery-optimisation
 /// exemption is the one sanctioned way an app can ask for around them, and it
 /// still needs one user tap.
 abstract final class PowerSettings {
  PowerSettings._();
  static const MethodChannel _channel = MethodChannel(
    'com.revoltvpn.app/power',
  );
  /// Whether the OS has exempted this app from Doze / App Standby.
  static Future<bool> isBatteryOptimisationDisabled() async {
    if (kIsWeb) return true;
    try {
      return await _channel.invokeMethod<bool>(
            'isIgnoringBatteryOptimizations',
          ) ??
          false;
    } catch (_) {
      return false;
    }
  }
  /// Shows the system exemption dialog. Returns false only when no system UI
  /// could be opened at all — a user declining still returns true.
  static Future<bool> requestDisableBatteryOptimisation() async {
    if (kIsWeb) return true;
    try {
      return await _channel.invokeMethod<bool>(
            'requestIgnoreBatteryOptimizations',
          ) ??
          false;
    } catch (_) {
      return false;
    }
  }
 }
@@ -0,0 +1,78 @@
 import 'dart:convert';
 import 'dart:io';
 import 'dart:math';
 class SecureSocksSession {
  static const String inboundTag = 'revolt-secure-socks';
  static final Random _random = Random.secure();
  final int port;
  final String username;
  final String password;
  final String configJson;
  const SecureSocksSession._({
    required this.port,
    required this.username,
    required this.password,
    required this.configJson,
  });
  static Future<SecureSocksSession> create(String baseConfig) async {
    final decoded = jsonDecode(baseConfig);
    if (decoded is! Map<String, dynamic>) {
      throw const FormatException('VLESS configuration must be a JSON object.');
    }
    final reservation = await ServerSocket.bind(
      InternetAddress.loopbackIPv4,
      0,
      shared: false,
    );
    final port = reservation.port;
    await reservation.close();
    if (port <= 1024 || port > 65535) {
      throw StateError('Could not allocate a safe local SOCKS5 port.');
    }
    final username = _token(16);
    final password = _token(32);
    // ReVolt owns local ingress. Never accept listeners supplied by a remote
    // or imported Xray config; the client exposes exactly one authenticated
    // loopback SOCKS5 listener for the current ephemeral session.
    decoded['inbounds'] = <Map<String, dynamic>>[
      <String, dynamic>{
        'tag': inboundTag,
        'port': port,
        'listen': '127.0.0.1',
        'protocol': 'socks',
        'settings': <String, dynamic>{
          'auth': 'password',
          'udp': true,
          'ip': '127.0.0.1',
          'users': <Map<String, String>>[
            <String, String>{'user': username, 'pass': password},
          ],
        },
        'sniffing': <String, dynamic>{
          'enabled': true,
          'destOverride': <String>['http', 'tls'],
        },
      },
    ];
    return SecureSocksSession._(
      port: port,
      username: username,
      password: password,
      configJson: jsonEncode(decoded),
    );
  }
  static String _token(int byteCount) {
    final bytes = List<int>.generate(byteCount, (_) => _random.nextInt(256));
    return bytes.map((value) => value.toRadixString(16).padLeft(2, '0')).join();
  }
 }
@@ -1,69 +0,0 @@
 import 'package:flutter/foundation.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 // ── lib/logic/server_list.dart ──────────────────────────────────────────────
 // Server data model and ChangeNotifier — shared by StatusBar (shows current
 // server name/flag) and SelectionScreen (lets user pick a server).
 //
 // Each server is defined by its tunnel IP/port. Reality keys (public key,
 // shortId, fingerprint) come from AppConfig — all servers share the same
 // Reality keypair and bootstrap UUID (same operator, different locations).
 //
 // When multi-server ships:
 //   - _all becomes a fetched list (from /api/servers or bundled config)
 //   - SelectionScreen shows multiple rows
 //   - select() triggers a disconnect/reconnect cycle if the tunnel is active
 class ServerInfo {
  final String id;
  final String name;
  final String flagAsset;
  final String ip;
  final int port;
  const ServerInfo({
    required this.id,
    required this.name,
    required this.flagAsset,
    required this.ip,
    required this.port,
  });
 }
 class ServerList extends ChangeNotifier {
  static const _all = [
    ServerInfo(
      id: 'finland',
      name: 'Helsinki, Finland',
      flagAsset: 'assets/finland_flag_256.png',
      ip: '204.168.246.88',
      port: 443,
    ),
  ];
  int _selectedIndex = 0;
  List<ServerInfo> get all => _all;
  int get selectedIndex => _selectedIndex;
  ServerInfo get selected => _all[_selectedIndex];
  // Loads persisted selection from SharedPreferences.
  // Fire-and-forget — UI starts with default, updates when prefs load.
  Future<void> init() async {
    final prefs = await SharedPreferences.getInstance();
    final saved = prefs.getInt('selected_server_index') ?? 0;
    if (saved >= 0 && saved < _all.length && saved != _selectedIndex) {
      _selectedIndex = saved;
      notifyListeners();
    }
  }
  // Switches to a different server. Persists the choice.
  Future<void> select(int index) async {
    if (index == _selectedIndex || index < 0 || index >= _all.length) return;
    _selectedIndex = index;
    notifyListeners();
    final prefs = await SharedPreferences.getInstance();
    await prefs.setInt('selected_server_index', index);
  }
 }
@@ -1,46 +1,80 @@
 import 'dart:async';
 import 'dart:convert';
 import 'package:flutter/foundation.dart';
 import 'package:revoltvpn/logic/hivemind_service.dart';
 import 'package:revoltvpn/logic/app_config.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/logic/crypto_service.dart';
-class SessionTimer extends ChangeNotifier {
+import 'package:flutter/widgets.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:revoltvpn/logic/app_config.dart';
 import 'package:revoltvpn/logic/crypto_service.dart';
 import 'package:revoltvpn/logic/hivemind_service.dart';
 import 'package:revoltvpn/logic/notification_service.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
  Timer? _timer;
  int _tickCount = 0;
  bool _appBackgrounded = false;
  final VpnConnection vpnConnection;
  int _remainingSeconds = 0;
  int _remainingAtLastSync = 0;
  int _usedBytes = 0;
  bool _hasSyncedOnce = false;
  int _consecutiveFailures = 0;
  bool _isDisconnecting = false;
-  bool _syncInProgress      = false;
+  int? _syncEpochInProgress;
  Completer<void>? _syncCompletion;
  int _sessionEpoch = 0;
  bool _supportRewardClaimed = false;
  bool _supportRewardStateLoaded = false;
  int _supportStateEpoch = 0;
  static const String _supportRewardClaimKey =
      'support_reward_claimed_active_session';
  static const FlutterSecureStorage _supportStorage = FlutterSecureStorage();
  static const int _maxConsecutiveFailures = 3;
  static const int _maxOfflineSeconds = 120;
  int _offlineSeconds = 0;
-  static const int _pollIntervalSeconds = 5;
+  static const int _pollIntervalSeconds = 60;
  static const int _backgroundPollIntervalSeconds = 60;
  int _lastUsedBytes = 0;
  Stopwatch? _sinceLastSuccessfulSync;
  // Wall clock, because the Stopwatch is CLOCK_MONOTONIC and stops across
  // device suspend - exactly when the RTC_WAKEUP expiry alarm fires.
  DateTime? _deadlineAt;
  double _currentSpeedKBps = 0.0;
  SessionTimer({required this.vpnConnection}) {
    WidgetsBinding.instance.addObserver(this);
    vpnConnection.addListener(_onVpnConnectionChanged);
    unawaited(_loadSupportRewardState());
    // VpnConnection is eager and can report an already-running native tunnel
    // before this provider is created. ChangeNotifier listeners do not replay
    // old events, so always evaluate the current state once after construction.
    unawaited(Future.microtask(_onVpnConnectionChanged));
  }
  int get remaining => _remainingSeconds;
  bool get isRunning => _timer != null && _timer!.isActive;
  bool get isExpired => _remainingSeconds <= 0 && !isRunning;
  bool get hasSyncedOnce => _hasSyncedOnce;
  bool get supportRewardClaimed => _supportRewardClaimed;
  bool get supportRewardStateLoaded => _supportRewardStateLoaded;
  int get usedBytes => _usedBytes;
  double get currentSpeedKBps => _currentSpeedKBps;
  // Display state only - an unreachable API never tears down a live tunnel.
  bool get serverUnreachable => _consecutiveFailures >= _maxConsecutiveFailures;
  // Why the last session ended, if the user did not end it. Cleared on connect.
  String? _lastEndMessage;
  String? get lastEndMessage => _lastEndMessage;
  String get formatted {
    final h = (_remainingSeconds ~/ 3600).toString().padLeft(2, '0');
    final m = ((_remainingSeconds % 3600) ~/ 60).toString().padLeft(2, '0');
@@ -48,169 +82,398 @@ class SessionTimer extends ChangeNotifier {
    return '$h:$m:$s';
  }
  Future<void> _loadSupportRewardState() async {
    final epoch = _supportStateEpoch;
    var claimed = false;
    try {
      claimed =
          (await _supportStorage.read(key: _supportRewardClaimKey)) == '1';
    } catch (e) {
      debugPrint('[Timer] Failed to load support reward state: $e');
    }
    if (epoch != _supportStateEpoch) return;
    _supportRewardClaimed = claimed;
    _supportRewardStateLoaded = true;
    notifyListeners();
  }
  Future<void> _persistSupportRewardState(bool value) async {
    try {
      await _supportStorage.write(
        key: _supportRewardClaimKey,
        value: value ? '1' : '0',
      );
    } catch (e) {
      debugPrint('[Timer] Failed to persist support reward state: $e');
    }
  }
  Future<void> markSupportRewardClaimed() async {
    if (_supportRewardClaimed) return;
    _supportRewardClaimed = true;
    _supportRewardStateLoaded = true;
    notifyListeners();
    await _persistSupportRewardState(true);
  }
  void _onVpnConnectionChanged() {
-    // Restore timer if VPN was already running at app launch.
+    // A live tunnel with a stopped clock is always wrong, whether this process
    // adopted an existing runtime, attached late, or recovered from a blip.
    if (vpnConnection.status == VpnStatus.connected &&
        !isRunning &&
-        vpnConnection.isStartupRestoration) {
+        !_isDisconnecting) {
      debugPrint('[Timer] Connected with a stopped clock - resuming.');
      _resumeTicking();
      return;
    }
-    // Resume after brief tunnel disconnection.
+    final hadActiveSession = isRunning || _hasSyncedOnce;
-    if (vpnConnection.status == VpnStatus.connected &&
+    if (!hadActiveSession || _isDisconnecting) return;
-        !isRunning &&
+
-        !_isDisconnecting &&
+    if (vpnConnection.status == VpnStatus.error) {
-        _hasSyncedOnce) {
+      unawaited(_doDisconnect(
-      debugPrint('[Timer] VPN reconnected after blip — resuming.');
+        'VPN entered error state',
-      _resumeTicking();
+        endedMessage: 'The tunnel stopped. You are not protected.',
      ));
      return;
    }
-    if (vpnConnection.status == VpnStatus.disconnected && !_isDisconnecting) {
+    if (vpnConnection.status == VpnStatus.disconnected) {
-      _doDisconnect('VPN tunnel dropped');
+      // The native deadline beats the 1 s tick, so expiry lands here, not in
      // _tick. postAlert is false: the service already posted, and a
      // notification-Disconnect tap is the user asking.
      final deadline = _deadlineAt;
      final expired = _hasSyncedOnce &&
          deadline != null &&
          DateTime.now().isAfter(
            deadline.subtract(const Duration(seconds: 5)),
          );
      unawaited(_doDisconnect(
        'VPN tunnel dropped',
        endedMessage:
            expired ? 'Your session ended. You are not protected.' : null,
        postAlert: false,
      ));
    }
  }
  Future<void> start() async {
    _sessionEpoch++;
    _remainingSeconds = 0;
    _remainingAtLastSync = 0;
    _usedBytes = 0;
    _lastUsedBytes = 0;
    _sinceLastSuccessfulSync?.stop();
    _sinceLastSuccessfulSync = null;
    _deadlineAt = null;
    _currentSpeedKBps = 0.0;
    _tickCount = 0;
    _hasSyncedOnce = false;
    _consecutiveFailures = 0;
    _offlineSeconds      = 0;
    _isDisconnecting = false;
    _appBackgrounded = false;
    _lastEndMessage = null;
    NotificationService.reset();
    // Every session is new, so the once-per-session top-up resets with it.
    _supportStateEpoch++;
    _supportRewardClaimed = false;
    _supportRewardStateLoaded = true;
    unawaited(_persistSupportRewardState(false));
    _timer?.cancel();
    _timer = Timer.periodic(const Duration(seconds: 1), _tick);
    notifyListeners();
-    _syncWithHivemind();
+    unawaited(_syncWithHivemind());
  }
  void _tick(Timer t) {
    if (_isDisconnecting) return;
    if (_hasSyncedOnce && _consecutiveFailures < _maxConsecutiveFailures) {
      if (_remainingSeconds > 0) {
        _remainingSeconds--;
      }
    }
-    if (_consecutiveFailures >= _maxConsecutiveFailures) {
+    if (_hasSyncedOnce) {
-      _offlineSeconds++;
+      _reconcileElapsedTime();
      if (_offlineSeconds >= _maxOfflineSeconds) {
        _doDisconnect('Server unreachable');
        return;
      }
    }
    if (_hasSyncedOnce && _remainingSeconds <= 0) {
-      _doDisconnect('Session expired');
+      unawaited(_doDisconnect(
        'Session expired',
        endedMessage: 'Your session ended. You are not protected.',
      ));
      return;
    }
    _tickCount++;
-    if (_tickCount % _pollIntervalSeconds == 0) {
+    final pollInterval = _appBackgrounded
-      _syncWithHivemind();
+        ? _backgroundPollIntervalSeconds
        : _pollIntervalSeconds;
    if (_tickCount % pollInterval == 0) {
      unawaited(_syncWithHivemind());
    }
    notifyListeners();
    if (_hasSyncedOnce && vpnConnection.status == VpnStatus.connected) {
      NotificationService.updateTimer(formatted);
    }
  }
  /// Force a control-plane refresh after an event that changes the session
  /// server-side. If a periodic sync is already in flight, wait for it and
  /// issue a fresh request so the event cannot be hidden behind the busy guard.
  Future<void> syncNow() async {
    final requestedEpoch = _sessionEpoch;
    while (requestedEpoch == _sessionEpoch && !_isDisconnecting) {
      final active = _syncEpochInProgress == requestedEpoch
          ? _syncCompletion
          : null;
      if (active != null) {
        await active.future;
        continue;
      }
      await _syncWithHivemind();
      return;
    }
  }
  Future<void> disconnect({String reason = 'User requested'}) async {
    // Only here, not in _doDisconnect: this is the one path the user actually
    // asked for. Unawaited so a slow or unreachable API never holds up the
    // teardown.
    unawaited(HivemindService.releaseSession());
    await _doDisconnect(reason);
  }
-  Future<void> _doDisconnect(String reason) async {
+  // endedMessage is what the UI shows; postAlert raises the notification.
  // A user-requested disconnect passes neither.
  Future<void> _doDisconnect(
    String reason, {
    String? endedMessage,
    bool postAlert = true,
  }) async {
    if (_isDisconnecting) return;
    _isDisconnecting = true;
    _sessionEpoch++;
    debugPrint('[Timer] Disconnecting: $reason');
    _lastEndMessage = endedMessage;
    _deadlineAt = null;
    _timer?.cancel();
    _timer = null;
    _currentSpeedKBps = 0.0;
    _remainingSeconds = 0;
    _remainingAtLastSync = 0;
    _hasSyncedOnce = false;
    _sinceLastSuccessfulSync?.stop();
    _sinceLastSuccessfulSync = null;
    NotificationService.reset();
    notifyListeners();
    await vpnConnection.disconnect();
    // After the service is down, so the cancel is not swallowed by a still
    // foreground notification. Without it a revoke leaves the countdown on
    // screen, frozen, claiming a session that no longer protects anything.
    await NotificationService.cancelTimer();
    if (endedMessage != null && postAlert) {
      unawaited(NotificationService.showDisconnectedAlert());
    }
    if (!_isDisconnecting) return;
    _isDisconnecting = false;
    notifyListeners();
  }
  int _readNonNegativeInt(dynamic value, int fallback) {
    if (value is int) return value >= 0 ? value : fallback;
    if (value is num && value >= 0) return value.toInt();
    return fallback;
  }
  Future<void> _syncWithHivemind() async {
-    if (_isDisconnecting || _syncInProgress) return;
+    if (_isDisconnecting) return;
-    _syncInProgress = true;
+    final epoch = _sessionEpoch;
    if (_syncEpochInProgress == epoch) return;
    final completion = Completer<void>();
    _syncCompletion = completion;
    _syncEpochInProgress = epoch;
    try {
      final deviceId = await CryptoService.getDeviceId();
-      final url = Uri.parse(
+      if (epoch != _sessionEpoch || _isDisconnecting) return;
-          '${AppConfig.hivemindApiPublic}/session/status?device_id=$deviceId');
+
      final base = Uri.parse('${AppConfig.hivemindApiPublic}/session/status');
      final url = base.replace(queryParameters: {'device_id': deviceId});
      final response = await HivemindService.directGet(url);
      if (epoch != _sessionEpoch || _isDisconnecting) return;
      if (response.statusCode == 200) {
-        final data = jsonDecode(response.body);
+        final decoded = jsonDecode(response.body);
        if (decoded is! Map<String, dynamic>) {
          debugPrint('[Timer] Invalid session payload type.');
          _markSyncFailure(epoch);
          return;
        }
        final data = decoded;
-        final bool active = data['active'] ?? false;
+        final activeValue = data['active'];
-        if (!active) {
+        if (activeValue is! bool) {
-          await _doDisconnect('Server ended session');
+          debugPrint('[Timer] Session payload missing boolean active state.');
          _markSyncFailure(epoch);
          return;
        }
        if (!activeValue) {
          await _doDisconnect(
            'Server ended session',
            endedMessage:
                'The server ended your session. You are not protected.',
          );
          return;
        }
-        _remainingSeconds = data['expires_in_seconds'] ?? _remainingSeconds;
+        final expiresValue = data['expires_in_seconds'];
-        _usedBytes        = data['used_bytes']        ?? _usedBytes;
+        if (expiresValue is! num ||
            !expiresValue.isFinite ||
            expiresValue < 0) {
          debugPrint('[Timer] Session payload has invalid expiry.');
          _markSyncFailure(epoch);
          return;
        }
-        final int deltaBytes = _usedBytes - _lastUsedBytes;
+        final elapsedMs = _sinceLastSuccessfulSync?.elapsedMilliseconds;
-        if (_hasSyncedOnce && deltaBytes > 0) {
+        _remainingAtLastSync = expiresValue.toInt();
-          _currentSpeedKBps = (deltaBytes / _pollIntervalSeconds) / 1000;
+        _remainingSeconds = _remainingAtLastSync;
-        } else if (!_hasSyncedOnce) {
+        _deadlineAt = DateTime.now().add(
          Duration(seconds: _remainingAtLastSync),
        );
        _usedBytes = _readNonNegativeInt(data['used_bytes'], _usedBytes);
        final deltaBytes = _usedBytes - _lastUsedBytes;
        if (_hasSyncedOnce && elapsedMs != null && elapsedMs > 0) {
          _currentSpeedKBps = deltaBytes > 0
              ? (deltaBytes / (elapsedMs / 1000.0)) / 1000.0
              : 0.0;
        } else {
          _currentSpeedKBps = 0.0;
        }
        _lastUsedBytes = _usedBytes;
        _sinceLastSuccessfulSync?.stop();
        _sinceLastSuccessfulSync = Stopwatch()..start();
-        final capExhausted = data['cap_exhausted'] ?? false;
+        if (data['cap_exhausted'] == true) {
-        if (capExhausted) {
+          await _doDisconnect(
-          await _doDisconnect('Data cap reached');
+            'Data cap reached',
            endedMessage: 'Data limit reached. You are not protected.',
          );
          return;
        }
        if (epoch != _sessionEpoch || _isDisconnecting) return;
        try {
          await vpnConnection.setNativeSessionDeadline(_remainingAtLastSync);
        } catch (e) {
          debugPrint('[Timer] Failed to arm native session deadline: $e');
          await _doDisconnect(
            'Native session deadline unavailable',
            endedMessage:
                'Could not arm the session timer. You are not protected.',
          );
          return;
        }
        if (epoch != _sessionEpoch || _isDisconnecting) return;
        _consecutiveFailures = 0;
        _offlineSeconds = 0;
        _hasSyncedOnce = true;
        notifyListeners();
      } else {
-        _markSyncFailure();
+        _markSyncFailure(epoch);
      }
    } catch (e) {
      if (epoch == _sessionEpoch && !_isDisconnecting) {
        debugPrint('Hivemind sync error: $e');
-      _markSyncFailure();
+        _markSyncFailure(epoch);
      }
    } finally {
-      _syncInProgress = false;
+      if (_syncEpochInProgress == epoch) {
        _syncEpochInProgress = null;
      }
      if (identical(_syncCompletion, completion)) {
        _syncCompletion = null;
      }
      if (!completion.isCompleted) completion.complete();
    }
  }
-  void _markSyncFailure() {
+  void _markSyncFailure(int epoch) {
    if (epoch != _sessionEpoch || _isDisconnecting) return;
    _consecutiveFailures++;
    if (_consecutiveFailures >= _maxConsecutiveFailures) {
      notifyListeners();
    }
  }
  void _reconcileElapsedTime() {
    final clock = _sinceLastSuccessfulSync;
    if (!_hasSyncedOnce || clock == null) return;
    final elapsed = clock.elapsed.inSeconds;
    _remainingSeconds =
        (_remainingAtLastSync - elapsed).clamp(0, 1 << 31).toInt();
    // The Stopwatch over-reports after device suspend. Take the smaller of
    // the two, never the wall clock alone - a backward clock must not extend.
    final deadline = _deadlineAt;
    if (deadline != null) {
      final byWallClock = deadline.difference(DateTime.now()).inSeconds;
      if (byWallClock < _remainingSeconds) {
        _remainingSeconds = byWallClock.clamp(0, 1 << 31).toInt();
      }
    }
  }
  @override
  void didChangeAppLifecycleState(AppLifecycleState state) {
    if (state == AppLifecycleState.paused ||
        state == AppLifecycleState.detached ||
        state == AppLifecycleState.inactive ||
        state == AppLifecycleState.hidden) {
      _appBackgrounded = true;
      return;
    }
    if (state != AppLifecycleState.resumed || _isDisconnecting) return;
    _appBackgrounded = false;
    if (vpnConnection.status != VpnStatus.connected) return;
    _reconcileElapsedTime();
    if (!isRunning) {
      _resumeTicking();
      return;
    }
    unawaited(_syncWithHivemind());
    notifyListeners();
  }
  void _resumeTicking() {
    _reconcileElapsedTime();
    _timer?.cancel();
    _timer = Timer.periodic(const Duration(seconds: 1), _tick);
    _isDisconnecting = false;
-    _syncWithHivemind();
+    unawaited(_syncWithHivemind());
    notifyListeners();
  }
  @override
  void dispose() {
    // Invalidate every asynchronous generation before removing listeners so
    // late storage/network completions cannot notify a disposed notifier.
    _sessionEpoch++;
    _supportStateEpoch++;
    _isDisconnecting = true;
    WidgetsBinding.instance.removeObserver(this);
    vpnConnection.removeListener(_onVpnConnectionChanged);
    _timer?.cancel();
    _sinceLastSuccessfulSync?.stop();
    super.dispose();
  }
 }
@@ -13,6 +13,78 @@ enum UpdateStatus { upToDate, updateAvailable, checkFailed }
 enum InstallSource { playStore, sideload }
 Uri? _trustedHttpsUri(String raw, Set<String> allowedHosts) {
  final uri = Uri.tryParse(raw);
  if (uri == null || uri.scheme != 'https' || !allowedHosts.contains(uri.host)) {
    return null;
  }
  return uri;
 }
 class _ParsedVersion {
  final List<int> core;
  final List<String> preRelease;
  const _ParsedVersion(this.core, this.preRelease);
  static _ParsedVersion? tryParse(String input) {
    var value = input.trim();
    if (value.startsWith('v') || value.startsWith('V')) {
      value = value.substring(1);
    }
    value = value.split('+').first;
    final dash = value.indexOf('-');
    final corePart = dash < 0 ? value : value.substring(0, dash);
    final prePart = dash < 0 ? '' : value.substring(dash + 1);
    final rawCore = corePart.split('.');
    if (rawCore.isEmpty || rawCore.any((p) => int.tryParse(p) == null)) {
      return null;
    }
    final core = rawCore.map(int.parse).toList(growable: false);
    while (core.length < 3) {
      core.add(0);
    }
    final pre = prePart.isEmpty
        ? const <String>[]
        : prePart.split('.').where((e) => e.isNotEmpty).toList(growable: false);
    return _ParsedVersion(core, pre);
  }
  int compareTo(_ParsedVersion other) {
    final length = core.length > other.core.length ? core.length : other.core.length;
    for (var i = 0; i < length; i++) {
      final left = i < core.length ? core[i] : 0;
      final right = i < other.core.length ? other.core[i] : 0;
      if (left != right) return left.compareTo(right);
    }
    if (preRelease.isEmpty && other.preRelease.isEmpty) return 0;
    if (preRelease.isEmpty) return 1;
    if (other.preRelease.isEmpty) return -1;
    final preLength = preRelease.length > other.preRelease.length
        ? preRelease.length
        : other.preRelease.length;
    for (var i = 0; i < preLength; i++) {
      if (i >= preRelease.length) return -1;
      if (i >= other.preRelease.length) return 1;
      final left = preRelease[i];
      final right = other.preRelease[i];
      final leftNum = int.tryParse(left);
      final rightNum = int.tryParse(right);
      if (leftNum != null && rightNum != null) {
        if (leftNum != rightNum) return leftNum.compareTo(rightNum);
        continue;
      }
      if (leftNum != null) return -1;
      if (rightNum != null) return 1;
      final lexical = left.compareTo(right);
      if (lexical != 0) return lexical;
    }
    return 0;
  }
 }
 class PlayStoreUpdater {
  PlayStoreUpdater._();
@@ -20,9 +92,13 @@ class PlayStoreUpdater {
      'https://play.google.com/store/apps/details?id=${AppConfig.applicationId}';
  static Future<bool> open() async {
    final uri = _trustedHttpsUri(_url, const {'play.google.com'});
    if (uri == null) {
      debugPrint('[Updater] Refusing invalid Play Store URL.');
      return false;
    }
    try {
-      return await launchUrl(Uri.parse(_url),
+      return await launchUrl(uri, mode: LaunchMode.externalApplication);
          mode: LaunchMode.externalApplication);
    } catch (e) {
      debugPrint('[Updater] Failed to open Play Store: $e');
      return false;
@@ -36,13 +112,14 @@ class GitHubUpdater {
  static String? _cachedDownloadUrl;
  static Future<String?> fetchLatestVersion() async {
-    final url =
+    final apiUri = Uri.https(
-        'https://api.github.com/repos/${AppConfig.githubOwner}/${AppConfig.githubRepo}/releases/latest';
+      'api.github.com',
      '/repos/${AppConfig.githubOwner}/${AppConfig.githubRepo}/releases/latest',
    );
    try {
      final response = await http
-          .get(Uri.parse(url),
+          .get(apiUri, headers: {'Accept': 'application/vnd.github+json'})
              headers: {'Accept': 'application/vnd.github+json'})
          .timeout(const Duration(seconds: 8));
      if (response.statusCode != 200) {
@@ -50,11 +127,32 @@ class GitHubUpdater {
        return null;
      }
-      final data = jsonDecode(response.body) as Map<String, dynamic>;
+      final decoded = jsonDecode(response.body);
-      _cachedDownloadUrl = data['html_url'] as String?;
+      if (decoded is! Map<String, dynamic>) {
        debugPrint('[Updater] Invalid GitHub release payload.');
        return null;
      }
-      final tag = data['tag_name'] as String? ?? '0.0.0';
+      final htmlUrl = decoded['html_url'];
-      return tag.startsWith('v') ? tag.substring(1) : tag;
+      if (htmlUrl is String &&
          _trustedHttpsUri(htmlUrl, const {'github.com'}) != null) {
        _cachedDownloadUrl = htmlUrl;
      } else {
        _cachedDownloadUrl = null;
      }
      final rawTag = decoded['tag_name'];
      if (rawTag is! String || rawTag.isEmpty || rawTag.length > 64) {
        debugPrint('[Updater] Invalid release tag.');
        return null;
      }
      final normalized = rawTag.startsWith('v') ? rawTag.substring(1) : rawTag;
      if (_ParsedVersion.tryParse(normalized) == null) {
        debugPrint('[Updater] Release tag is not a supported version: $rawTag');
        return null;
      }
      return normalized;
    } catch (e) {
      debugPrint('[Updater] GitHub API error: $e');
      return null;
@@ -62,10 +160,15 @@ class GitHubUpdater {
  }
  static Future<bool> open() async {
-    final url = _cachedDownloadUrl ?? AppConfig.githubReleasesUrl;
+    final raw = _cachedDownloadUrl ?? AppConfig.githubReleasesUrl;
    final uri = _trustedHttpsUri(raw, const {'github.com'});
    if (uri == null) {
      debugPrint('[Updater] Refusing untrusted GitHub update URL.');
      return false;
    }
    try {
-      return await launchUrl(Uri.parse(url),
+      return await launchUrl(uri, mode: LaunchMode.externalApplication);
          mode: LaunchMode.externalApplication);
    } catch (e) {
      debugPrint('[Updater] Failed to open GitHub: $e');
      return false;
@@ -86,7 +189,7 @@ class Updater {
    }
    try {
-      final result = await MethodChannel('com.revoltvpn.app/installer')
+      final result = await const MethodChannel('com.revoltvpn.app/installer')
          .invokeMethod<String>('getInstallerPackage');
      _cachedSource = (result == 'com.android.vending')
          ? InstallSource.playStore
@@ -100,51 +203,68 @@ class Updater {
  }
  static int _compareVersions(String a, String b) {
-    final aParts = a.split('.').map((p) => int.tryParse(p) ?? 0).toList();
+    final left = _ParsedVersion.tryParse(a);
-    final bParts = b.split('.').map((p) => int.tryParse(p) ?? 0).toList();
+    final right = _ParsedVersion.tryParse(b);
-    for (int i = 0; i < 3; i++) {
+    if (left == null || right == null) {
-      final diff = (aParts.length > i ? aParts[i] : 0) -
+      // Invalid local metadata should not invent an ordering.
          (bParts.length > i ? bParts[i] : 0);
      if (diff != 0) return diff;
    }
      return 0;
    }
    return left.compareTo(right);
  }
  static String _versionLabel(String v, bool isLocal) {
    final prefix = v.startsWith('v') ? '' : 'v';
    return '$prefix$v${isLocal ? ' (installed)' : ''}';
  }
-  static Future<void> check(BuildContext context) async {
+  static Future<void> check(BuildContext context) {
    final navigator = Navigator.of(context, rootNavigator: true);
    final messenger = ScaffoldMessenger.of(context);
    return checkWithHandles(
      navigator: navigator,
      messenger: messenger,
    );
  }
  static Future<void> checkWithHandles({
    required NavigatorState navigator,
    required ScaffoldMessengerState messenger,
  }) async {
    final info = await PackageInfo.fromPlatform();
    final localVersion = info.version;
-    if (localVersion.isEmpty) {
+    if (localVersion.isEmpty || _ParsedVersion.tryParse(localVersion) == null) {
-      _showSnackBar(context, 'Could not determine app version',
+      _showSnackBar(
-          isError: true);
+        messenger,
        'Could not determine app version',
        isError: true,
      );
      return;
    }
    final latestVersion = await GitHubUpdater.fetchLatestVersion();
    if (latestVersion == null) {
-      _showSnackBar(context, 'Could not reach GitHub', isError: true);
+      _showSnackBar(messenger, 'Could not reach GitHub', isError: true);
      return;
    }
    if (_compareVersions(localVersion, latestVersion) >= 0) {
-      _showSnackBar(context, 'Up to date');
+      _showSnackBar(messenger, 'Up to date');
      return;
    }
    final source = await installSource;
-    final storeName = source == InstallSource.playStore ? 'Play Store' : 'GitHub';
+    final storeName =
-    if (!context.mounted) return;
+        source == InstallSource.playStore ? 'Play Store' : 'GitHub';
    if (!navigator.mounted) return;
    showDialog(
-      context: context,
+      context: navigator.context,
      builder: (ctx) => AlertDialog(
        backgroundColor: AppColors.bgCard,
-        title: const Text('Update available',
+        title: const Text(
-            style: TextStyle(color: AppColors.textWhite)),
+          'Update available',
          style: TextStyle(color: AppColors.textWhite),
        ),
        content: Text(
          '${_versionLabel(latestVersion, false)} is available on $storeName.\n'
          'You have ${_versionLabel(localVersion, true)}.',
@@ -153,8 +273,10 @@ class Updater {
        actions: [
          TextButton(
            onPressed: () => Navigator.pop(ctx),
-            child: const Text('Later',
+            child: const Text(
-                style: TextStyle(color: AppColors.slate70)),
+              'Later',
              style: TextStyle(color: AppColors.slate70),
            ),
          ),
          TextButton(
            onPressed: () {
@@ -163,23 +285,31 @@ class Updater {
                  ? PlayStoreUpdater.open()
                  : GitHubUpdater.open();
            },
-            child: Text('Open $storeName',
+            child: Text(
-                style: const TextStyle(color: AppColors.accent)),
+              'Open $storeName',
              style: const TextStyle(color: AppColors.accent),
            ),
          ),
        ],
      ),
    );
  }
-  static void _showSnackBar(BuildContext context, String message,
+  static void _showSnackBar(
-      {bool isError = false}) {
+    ScaffoldMessengerState messenger,
-    ScaffoldMessenger.of(context).showSnackBar(
+    String message, {
    bool isError = false,
  }) {
    if (!messenger.mounted) return;
    messenger.showSnackBar(
      SnackBar(
        content: Row(
          children: [
-            Icon(isError ? Icons.error_outline : Icons.check_circle,
+            Icon(
              isError ? Icons.error_outline : Icons.check_circle,
              color: isError ? AppColors.red : AppColors.green,
-                size: 18),
+              size: 18,
            ),
            const SizedBox(width: 8),
            Text(message),
          ],
@@ -1,8 +1,13 @@
 import 'dart:async';
-import 'dart:convert';
+
 import 'package:flutter/foundation.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_vless/flutter_vless.dart';
 import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/hivemind_service.dart';
 import 'package:revoltvpn/logic/local_socks_tester.dart';
 import 'package:revoltvpn/logic/network_monitor.dart';
 import 'package:revoltvpn/logic/secure_socks_session.dart';
 enum VpnStatus {
  disconnected,
@@ -13,7 +18,12 @@ enum VpnStatus {
 }
 class VpnConnection extends ChangeNotifier {
-  bool _cancelled = false;
+  static const MethodChannel _nativeControl = MethodChannel('flutter_vless');
  int _connectEpoch = 0;
  bool _suppressNativeConnect = false;
  bool _disposed = false;
  VpnStatus _status = VpnStatus.disconnected;
  VpnStatus get status => _status;
@@ -23,28 +33,81 @@ class VpnConnection extends ChangeNotifier {
  String? _errorMessage;
  String? get errorMessage => _errorMessage;
-  bool _isStartupRestoration = false;
+  /// True when the UI attached to a tunnel that was already running, rather
-  bool get isStartupRestoration => _isStartupRestoration;
+  /// than starting one itself. The session timer uses this to resume ticking.
  bool _adoptedRunningRuntime = false;
  bool get adoptedRunningRuntime => _adoptedRunningRuntime;
-  bool _serverReachable = false;
+  ConnectionMode _activeMode = ConnectionMode.tun;
-  bool get serverReachable => _serverReachable;
+  ConnectionMode get activeMode => _activeMode;
-  Timer? _healthTimer;
+  String _networkTransport = 'unknown';
  String get networkTransport => _networkTransport;
  SecureSocksSession? get activeSocksSession => _lastSecureSocks;
  bool get canTestActiveLocalSocks =>
      !_disposed &&
      _status == VpnStatus.connected &&
      _activeMode == ConnectionMode.proxy &&
      _lastSecureSocks != null;
  Future<LocalSocksTestResult> testActiveLocalSocks() async {
    final active = _lastSecureSocks;
    if (!canTestActiveLocalSocks || active == null) {
      return const LocalSocksTestResult(
        ok: false,
        latencyMs: null,
        message: 'No active authenticated SOCKS5 session.',
      );
    }
    return LocalSocksTester.test(
      host: '127.0.0.1',
      port: active.port,
      username: active.username,
      password: active.password,
    );
  }
  StreamSubscription<NetworkSnapshot>? _networkSubscription;
  SecureSocksSession? _lastSecureSocks;
  bool _userDisconnecting = false;
  late final FlutterVless _vless;
  bool _initialized = false;
  final Completer<void> _readyCompleter = Completer<void>();
  Future<void> get ready => _readyCompleter.future;
  VpnConnection() {
    _activeMode = ConnectionSettings.mode;
    _init();
  }
  Future<void> _init() async {
-    if (kIsWeb) return;
+    try {
      await _startEngine();
    } catch (e) {
      debugPrint('[VPN] Engine init failed: $e');
    } finally {
      if (!_readyCompleter.isCompleted) _readyCompleter.complete();
    }
  }
  Future<void> _startEngine() async {
    if (kIsWeb || _disposed) return;
    await ConnectionSettings.initialize();
    if (_disposed) return;
    _activeMode = ConnectionSettings.mode;
    _vless = FlutterVless(
      onStatusChanged: (status) {
-        debugPrint('[VPN] Status: state=${status.state} '
+        debugPrint(
-            'connection=${status.connectionState.name}');
+          '[VPN] Status: state=${status.state} '
          'connection=${status.connectionState.name}',
        );
        _mapStatus(status);
      },
    );
@@ -55,44 +118,71 @@ class VpnConnection extends ChangeNotifier {
        notificationIconResourceType: 'drawable',
        notificationIconResourceName: 'notification_icon',
      );
      if (_disposed) return;
      _initialized = true;
    } catch (e) {
      debugPrint('[VPN] VLESS init error (expected on emulator): $e');
    }
    if (_disposed) return;
-    _checkHealth();
+    _networkSubscription = NetworkMonitor.changes.listen(
-    _healthTimer =
+      (snapshot) {
-        Timer.periodic(const Duration(seconds: 30), (_) => _checkHealth());
+        if (_disposed) return;
        // ConnectivityManager is informational only. Restarting from every
        // callback caused the old VPN-created-network reconnect loop.
        _networkTransport = snapshot.transport;
        notifyListeners();
      },
      onError: (Object error) {
        debugPrint('[VPN] Network monitor error: $error');
      },
    );
    try {
      final coreVersion = await _vless.getCoreVersion();
      if (!_disposed) {
        debugPrint('[VPN] Xray core version: $coreVersion');
      final delay = await _vless.getConnectedServerDelay();
      if (delay > 0) {
        _isStartupRestoration = true;
        _setStatus(VpnStatus.connected, 'Secured');
      }
    } catch (_) {}
  }
  String get _connectedLabel {
    switch (_activeMode) {
      case ConnectionMode.proxy:
        return 'SOCKS5 gateway active';
      case ConnectionMode.tun:
        return 'Secured';
    }
  }
  bool _isCurrentConnect(int epoch) =>
      !_disposed && epoch == _connectEpoch && !_userDisconnecting;
  void _mapStatus(VlessStatus status) {
    if (_disposed) return;
    switch (status.connectionState) {
      case VlessConnectionState.connected:
-        _setStatus(VpnStatus.connected, 'Secured');
+        if (_suppressNativeConnect || _userDisconnecting) return;
        if (_connectEpoch == 0) _adoptedRunningRuntime = true;
        _setStatus(VpnStatus.connected, _connectedLabel);
        break;
      case VlessConnectionState.disconnected:
-        _isStartupRestoration = false;
+        _clearRuntimeSnapshot();
        _setStatus(VpnStatus.disconnected, 'Tap to connect');
        break;
      case VlessConnectionState.connecting:
        if (_suppressNativeConnect || _userDisconnecting) return;
        _setStatus(VpnStatus.connecting, 'Establishing tunnel…');
        break;
      case VlessConnectionState.disconnecting:
        _isStartupRestoration = false;
        _setStatus(VpnStatus.disconnecting, 'Tearing down…');
        break;
      case VlessConnectionState.unknown:
        if (_suppressNativeConnect || _userDisconnecting) return;
        if (_status != VpnStatus.connected &&
            _status != VpnStatus.disconnected) {
          _setStatus(VpnStatus.error, 'Connection failed');
@@ -101,43 +191,62 @@ class VpnConnection extends ChangeNotifier {
    }
  }
-  // ── Connect ────────────────────────────────────────────────────────
+  Future<bool> connect({String? adNonce}) async {
-  //
+    if (_disposed ||
-  // 1. Direct HTTPS to the public API → get per-user VLESS URL
+        _userDisconnecting ||
-  // 2. Start tunnel directly with that URL (no bootstrap, no switch)
+        _status == VpnStatus.connected ||
-  //
+        _status == VpnStatus.connecting ||
-  // The only hardcoded data in the APK is the Reality public key and
+        _status == VpnStatus.disconnecting) {
  // shortId (needed for every Reality handshake — unavoidable).
  // The tunnel UUID is per-user, assigned by Hivemind via AdMob SSV.
  Future<bool> connect({
    bool skipAdBypass = false,
  }) async {
    if (_status == VpnStatus.connected || _status == VpnStatus.connecting) {
      return false;
    }
-    _cancelled = false;
+
    final connectEpoch = ++_connectEpoch;
    _suppressNativeConnect = false;
    _userDisconnecting = false;
    await ConnectionSettings.initialize();
    if (!_isCurrentConnect(connectEpoch)) return false;
    _activeMode = ConnectionSettings.mode;
    if (!kIsWeb && !_initialized) {
      _suppressNativeConnect = true;
      _errorMessage = 'VPN service unavailable.';
      _setStatus(VpnStatus.error, 'Service unavailable');
      return false;
    }
-    if (!kIsWeb) {
+    // Proxy mode skips requestPermission below (VPN consent it never needs),
    // so it has to ask for POST_NOTIFICATIONS on its own.
    if (!kIsWeb && _activeMode == ConnectionMode.proxy) {
      try {
        await _nativeControl.invokeMethod<void>('requestNotificationPermission');
      } catch (e) {
        debugPrint('[VPN] Notification permission request failed: $e');
      }
      if (!_isCurrentConnect(connectEpoch)) return false;
    }
    if (!kIsWeb && _activeMode == ConnectionMode.tun) {
      final ok = await _vless.requestPermission();
      if (!_isCurrentConnect(connectEpoch)) return false;
      if (!ok) {
        _suppressNativeConnect = true;
        _errorMessage = 'VPN permission denied.';
        _setStatus(VpnStatus.error, 'Permission required');
        return false;
      }
    }
-    _setStatus(VpnStatus.connecting, 'Establishing secure channel…');
+    final startingMessage = switch (_activeMode) {
      ConnectionMode.tun => 'Establishing secure channel…',
      ConnectionMode.proxy => 'Starting local SOCKS5 proxy…',
    };
    _setStatus(VpnStatus.connecting, startingMessage);
    _errorMessage = null;
    if (kIsWeb) {
      await Future.delayed(const Duration(seconds: 1));
      if (!_isCurrentConnect(connectEpoch)) return false;
      _setStatus(VpnStatus.connected, 'Secured (dev mode)');
      return true;
    }
@@ -147,124 +256,223 @@ class VpnConnection extends ChangeNotifier {
    String realUrl;
    try {
      realUrl = await HivemindService.fetchConfigDirectly(
-        skipAdBypass: skipAdBypass,
+        adNonce: adNonce,
        onAttempt: (attempt, total) {
          if (!_isCurrentConnect(connectEpoch)) return;
          _setStatus(
-              VpnStatus.connecting, 'Contacting server ($attempt/$total)…');
+            VpnStatus.connecting,
            'Contacting server ($attempt/$total)…',
          );
        },
      );
    } catch (e) {
      if (!_isCurrentConnect(connectEpoch)) return false;
      debugPrint('[VPN] Config fetch error: $e');
      final raw = e.toString().replaceAll('Exception: ', '');
      if (raw.contains('Cancelled')) return false;
      _suppressNativeConnect = true;
      if (raw.contains('timed out') || raw.contains('Session not activated')) {
        _errorMessage =
            'The server did not respond in time.\nCheck your connection and try again.';
        _setStatus(VpnStatus.error, 'Server unreachable');
      } else {
-        _errorMessage = e.toString().replaceAll('Exception: ', '');
+        _errorMessage = raw;
        _setStatus(VpnStatus.error, 'Config fetch error');
      }
      return false;
    }
-    if (_cancelled) {
+    if (!_isCurrentConnect(connectEpoch)) return false;
-      _setStatus(VpnStatus.disconnected, 'Tap to connect');
+    _setStatus(VpnStatus.connecting, 'Starting secure route…');
      return false;
    }
    _setStatus(VpnStatus.connecting, 'Securing connection…');
    try {
      final parsed = FlutterVless.parse(realUrl);
-      final configJson =
+      final baseConfig = parsed.getFullConfiguration();
-          jsonDecode(parsed.getFullConfiguration()) as Map<String, dynamic>;
+      final remark = parsed.remark.isNotEmpty ? parsed.remark : 'Revolt VPN';
      final secureSocks = await SecureSocksSession.create(baseConfig);
      if (!_isCurrentConnect(connectEpoch)) return false;
      final verifyLocalSocks = _activeMode == ConnectionMode.proxy;
-      // Inject HTTP inbound for tunnel-internal API calls.
+      await _startRuntime(
-      final inbounds = (configJson['inbounds'] as List?) ?? [];
+        config: secureSocks.configJson,
-      inbounds.add({
+        remark: remark,
-        'tag': 'http-proxy',
+        proxyOnly: verifyLocalSocks,
        'port': 10808,
        'listen': '127.0.0.1',
        'protocol': 'http',
      });
      configJson['inbounds'] = inbounds;
      await _vless.startVless(
        remark: parsed.remark.isNotEmpty ? parsed.remark : 'Revolt VPN',
        config: jsonEncode(configJson),
      );
      if (!_isCurrentConnect(connectEpoch)) return false;
      _setStatus(
        VpnStatus.connecting,
        verifyLocalSocks
            ? 'Waiting for local SOCKS5…'
            : 'Waiting for VPN interface…',
      );
      if (!await _waitForNativeConnected(connectEpoch)) {
        throw StateError('VPN runtime did not report CONNECTED');
      }
      if (verifyLocalSocks) {
        if (!_isCurrentConnect(connectEpoch)) return false;
        _setStatus(VpnStatus.connecting, 'Checking Local SOCKS5…');
        if (!await _waitForLocalSocksListener(
          secureSocks,
          connectEpoch,
        )) {
          throw StateError('Local SOCKS5 listener did not become ready');
        }
      }
      if (!_isCurrentConnect(connectEpoch)) return false;
      _lastSecureSocks = secureSocks;
    } catch (e) {
      if (!_isCurrentConnect(connectEpoch)) return false;
      debugPrint('[VPN] Tunnel start error: $e');
-      _errorMessage = 'Tunnel failed to start.\nTry reconnecting.';
+      _suppressNativeConnect = true;
      try {
        await _stopRuntime();
      } catch (stopError) {
        debugPrint('[VPN] Runtime cleanup failed after start error: $stopError');
        if (!_isCurrentConnect(connectEpoch)) return false;
        _errorMessage = 'VPN failed to shut down cleanly.\nPlease restart the app.';
        _setStatus(VpnStatus.error, 'Shutdown failed');
        return false;
      }
      if (!_isCurrentConnect(connectEpoch)) return false;
      _clearRuntimeSnapshot();
      _errorMessage = _activeMode == ConnectionMode.proxy
          ? 'SOCKS5 gateway failed to start.\nTry reconnecting.'
          : 'Connection failed to start.\nTry reconnecting.';
      _setStatus(VpnStatus.error, 'Connection failed');
      return false;
    }
-    _setStatus(VpnStatus.connected, 'Secured');
+    if (!_isCurrentConnect(connectEpoch)) return false;
    _setStatus(VpnStatus.connected, _connectedLabel);
    return true;
  }
-  Future<void> disconnect() async {
+  Future<void> _startRuntime({
-    _cancelled = true;
+    required String config,
-    HivemindService.cancel();
+    required String remark,
-    if (_status == VpnStatus.disconnected ||
+    required bool proxyOnly,
-        _status == VpnStatus.disconnecting) {
+  }) async {
-      return;
+    await _vless.startVless(
      remark: remark,
      config: config,
      proxyOnly: proxyOnly,
    );
  }
  Future<bool> _waitForLocalSocksListener(
    SecureSocksSession session,
    int connectEpoch,
  ) async {
    for (var attempt = 0; attempt < 4; attempt++) {
      if (!_isCurrentConnect(connectEpoch)) return false;
      final result = await LocalSocksTester.testListener(
        host: '127.0.0.1',
        port: session.port,
        username: session.username,
        password: session.password,
      );
      if (!_isCurrentConnect(connectEpoch)) return false;
      if (result.ok) return true;
      if (attempt < 3) {
        await Future.delayed(const Duration(milliseconds: 250));
      }
    }
    return false;
  }
  Future<bool> _waitForNativeConnected(int connectEpoch) async {
    for (var attempt = 0; attempt < 24; attempt++) {
      if (!_isCurrentConnect(connectEpoch)) return false;
      if (_status == VpnStatus.connected) return true;
      if (_status == VpnStatus.error || _status == VpnStatus.disconnected) {
        return false;
      }
      await Future.delayed(const Duration(milliseconds: 250));
    }
    return _isCurrentConnect(connectEpoch) &&
        _status == VpnStatus.connected;
  }
  Future<void> _stopRuntime() async {
    await _vless.stopVless().timeout(const Duration(seconds: 8));
  }
  Future<void> setNativeSessionDeadline(int remainingSeconds) async {
    if (kIsWeb) return;
    if (_disposed) throw StateError('VPN connection has been disposed');
    if (!_initialized) throw StateError('VPN native service is not initialized');
    if (remainingSeconds < 0) {
      throw ArgumentError.value(remainingSeconds, 'remainingSeconds');
    }
    await _nativeControl.invokeMethod<void>(
      'setSessionDeadline',
      <String, Object>{'remainingSeconds': remainingSeconds},
    );
  }
  Future<void> disconnect() async {
    if (_disposed || _status == VpnStatus.disconnecting) return;
    _connectEpoch++;
    _suppressNativeConnect = true;
    _userDisconnecting = true;
    HivemindService.cancel();
    _setStatus(VpnStatus.disconnecting, 'Tearing down…');
    if (kIsWeb) {
      await Future.delayed(const Duration(milliseconds: 500));
      if (_disposed) return;
      _clearRuntimeSnapshot();
      _setStatus(VpnStatus.disconnected, 'Tap to connect');
      _userDisconnecting = false;
      return;
    }
    bool timedOut = false;
    try {
-      await _vless.stopVless().timeout(
+      await _vless.stopVless().timeout(const Duration(seconds: 8));
            const Duration(seconds: 5),
            onTimeout: () => timedOut = true,
          );
    } catch (e) {
      if (_disposed) return;
      debugPrint('[VPN] VLESS stop error: $e');
      _errorMessage = 'VPN shutdown error.\nPlease restart the app.';
      _clearRuntimeSnapshot();
      _setStatus(VpnStatus.error, 'Shutdown failed');
      _userDisconnecting = false;
      return;
    }
-    if (timedOut) {
+    if (_disposed) return;
-      debugPrint('[VPN] stopVless() timed out after 5 s — '
+    _errorMessage = null;
-          'tunnel may still be active.');
+    _clearRuntimeSnapshot();
      _errorMessage = 'VPN did not shut down cleanly.\n'
          'Please restart the app.';
      _setStatus(VpnStatus.error, 'Shutdown failed');
      return;
    }
    _setStatus(VpnStatus.disconnected, 'Tap to connect');
    _userDisconnecting = false;
  }
-  void _setStatus(VpnStatus s, String msg) {
+  void _clearRuntimeSnapshot() {
-    _status = s;
+    _lastSecureSocks = null;
-    _statusMessage = msg;
+    _adoptedRunningRuntime = false;
    notifyListeners();
  }
-  Future<void> _checkHealth() async {
+  void _setStatus(VpnStatus status, String message) {
-    _serverReachable = await HivemindService.checkHealth();
+    if (_disposed) return;
    _status = status;
    _statusMessage = message;
    notifyListeners();
  }
  @override
  void dispose() {
-    _healthTimer?.cancel();
+    _disposed = true;
-    if (_status == VpnStatus.connected || _status == VpnStatus.connecting) {
+    _connectEpoch++;
-      try {
+    _suppressNativeConnect = true;
-        _vless.stopVless();
+    _userDisconnecting = true;
-      } catch (_) {}
+    HivemindService.cancel();
-    }
+    _networkSubscription?.cancel();
    // Provider/UI disposal is not a user disconnect command. Keeping teardown
    // in disconnect() prevents lifecycle churn from silently dropping the VPN.
    super.dispose();
  }
 }
@@ -1,22 +1,22 @@
 import 'package:flutter/material.dart';
 import 'dart:ui';
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:provider/provider.dart';
 import 'package:google_mobile_ads/google_mobile_ads.dart';
 import 'package:package_info_plus/package_info_plus.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/ad_manager.dart';
 import 'package:revoltvpn/logic/server_list.dart';
 import 'package:revoltvpn/logic/consent_manager.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/haptic_settings.dart';
 import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/screens/intro.dart';
-void main() async {
+Future<void> main() async {
  WidgetsFlutterBinding.ensureInitialized();
-  SystemChrome.setPreferredOrientations([DeviceOrientation.portraitUp]);
+  await HapticSettings.initialize();
  await ConnectionSettings.initialize();
  await SystemChrome.setPreferredOrientations([DeviceOrientation.portraitUp]);
  SystemChrome.setSystemUIOverlayStyle(const SystemUiOverlayStyle(
    statusBarColor: Colors.transparent,
@@ -34,33 +34,27 @@ void main() async {
    return true;
  };
  await ConsentManager.requestConsentIfNeeded();
  await MobileAds.instance.initialize();
  final packageInfo = await PackageInfo.fromPlatform();
  ReVoltApp.appVersion = packageInfo.version;
  runApp(const ReVoltApp());
 }
 class ReVoltApp extends StatelessWidget {
  const ReVoltApp({super.key});
  /// Set at startup from PackageInfo — used by sidebar and anywhere
  /// the app version needs to be displayed.
  static String appVersion = '';
  @override
  Widget build(BuildContext context) {
    return MultiProvider(
      providers: [
-        ChangeNotifierProvider(create: (_) => VpnConnection()),
+        ChangeNotifierProvider(create: (_) => VpnConnection(), lazy: false),
        ChangeNotifierProxyProvider<VpnConnection, SessionTimer>(
-          create: (ctx) => SessionTimer(vpnConnection: ctx.read<VpnConnection>()),
+          // Eager, like VpnConnection: the timer has to be listening before the
-          update: (_, vpn, prev) => prev ?? SessionTimer(vpnConnection: vpn),
+          // engine reports an already-running tunnel, not after the intro.
          lazy: false,
          create: (ctx) =>
              SessionTimer(vpnConnection: ctx.read<VpnConnection>()),
          update: (_, vpn, prev) =>
              prev ?? SessionTimer(vpnConnection: vpn),
        ),
        ChangeNotifierProvider(create: (_) => AdManager()),
        ChangeNotifierProvider(create: (_) => ServerList()..init()),
      ],
      child: MaterialApp(
        title: 'ReVolt VPN',
@@ -1,7 +1,12 @@
 import 'dart:async';
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/haptic_settings.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 import 'package:revoltvpn/screens/main_screen.dart';
 import 'package:revoltvpn/screens/settings/in_settings/rain.dart';
 import 'package:revoltvpn/screens/settings/in_settings/lightning.dart';
 class IntroScreen extends StatefulWidget {
  const IntroScreen({super.key});
@@ -11,11 +16,18 @@ class IntroScreen extends StatefulWidget {
 }
 class _IntroScreenState extends State<IntroScreen> with WidgetsBindingObserver {
  static const _minDisplay = Duration(milliseconds: 500);
  static const _bootTimeout = Duration(seconds: 8);
  String _status = 'Starting secure engine…';
  bool _bootComplete = false;
  bool _navigated = false;
  @override
  void initState() {
    super.initState();
    WidgetsBinding.instance.addObserver(this);
-    _scheduleNavigation();
+    _boot();
  }
  @override
@@ -26,28 +38,56 @@ class _IntroScreenState extends State<IntroScreen> with WidgetsBindingObserver {
  @override
  void didChangeAppLifecycleState(AppLifecycleState state) {
-    if (state == AppLifecycleState.resumed) {
+    if (state == AppLifecycleState.resumed) _navigateIfReady();
      _navigateToMain();
  }
  Future<void> _boot() async {
    final elapsed = Stopwatch()..start();
    final vpn = context.read<VpnConnection>();
    // The overlays and haptic layer read these before MainScreen mounts.
    final settingsPrefs = Future.wait([
      loadRainPref(),
      loadLightningPref(),
      HapticSettings.initialize(),
    ]);
    try {
      await vpn.ready.timeout(_bootTimeout);
    } on TimeoutException {
      debugPrint('[Boot] Engine init exceeded ${_bootTimeout.inSeconds}s '
          '— continuing to the main screen anyway.');
    } catch (e) {
      debugPrint('[Boot] Engine init error: $e');
    }
    try {
      await settingsPrefs;
    } catch (e) {
      debugPrint('[Boot] Settings prefs load failed, using defaults: $e');
    }
  void _scheduleNavigation() {
    // Brief natural pause — just long enough to perceive the logo.
    Timer(const Duration(milliseconds: 1200), () {
    if (!mounted) return;
    setState(() => _status = 'Ready');
    final remaining = _minDisplay - elapsed.elapsed;
    if (remaining > Duration.zero) await Future.delayed(remaining);
    if (!mounted) return;
    _bootComplete = true;
    _navigateIfReady();
  }
  void _navigateIfReady() {
    if (!mounted || _navigated || !_bootComplete) return;
    if (WidgetsBinding.instance.lifecycleState == AppLifecycleState.paused) {
        // App is backgrounded — defer navigation until resumed.
      return;
    }
-      _navigateToMain();
+    _navigated = true;
    });
  }
  void _navigateToMain() {
    if (!mounted) return;
    Navigator.of(context).pushReplacement(
      PageRouteBuilder(
-        transitionDuration: const Duration(milliseconds: 600),
+        transitionDuration: const Duration(milliseconds: 400),
        pageBuilder: (_, __, ___) => const MainScreen(),
        transitionsBuilder: (_, animation, __, child) {
          return FadeTransition(opacity: animation, child: child);
@@ -63,7 +103,6 @@ class _IntroScreenState extends State<IntroScreen> with WidgetsBindingObserver {
      body: Column(
        children: [
          const Spacer(flex: 7),
          // Image slightly below center
          Center(
            child: Image.asset(
              'assets/brand.png',
@@ -78,7 +117,6 @@ class _IntroScreenState extends State<IntroScreen> with WidgetsBindingObserver {
              },
            ),
          ),
          // Spinner + text paired together below the image
          const SizedBox(height: 8),
          const SizedBox(
            width: 40,
@@ -98,6 +136,19 @@ class _IntroScreenState extends State<IntroScreen> with WidgetsBindingObserver {
              letterSpacing: 2.0,
            ),
          ),
          const SizedBox(height: 10),
          AnimatedSwitcher(
            duration: const Duration(milliseconds: 250),
            child: Text(
              _status,
              key: ValueKey(_status),
              style: const TextStyle(
                color: AppColors.textDim,
                fontSize: 13,
                letterSpacing: 0.5,
              ),
            ),
          ),
          const Spacer(flex: 5),
          const SizedBox(height: 12),
        ],
@@ -1,63 +0,0 @@
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/server_list.dart';
 // ── lib/screens/server_selector/selection_screen.dart ──────────────────────
 // Server picker — reads the server list from the ServerList provider.
 // Each row shows a flag + city name.  Tapping a row persists the choice
 // and pops back.  No latency measurement — the app runs inside a Reality
 // tunnel and must not emit separate probe traffic.
 class SelectionScreen extends StatelessWidget {
  const SelectionScreen({super.key});
  @override
  Widget build(BuildContext context) {
    final serverList = context.watch<ServerList>();
    return Scaffold(
      backgroundColor: AppColors.bgDeep,
      appBar: AppBar(
        backgroundColor: AppColors.bgSurface,
        elevation: 0,
        leading: IconButton(
          icon: const Icon(Icons.arrow_back, color: AppColors.textWhite),
          onPressed: () => Navigator.of(context).pop(),
        ),
        title: const Text(
          'Select Server',
          style: TextStyle(
            color: AppColors.textWhite,
            fontWeight: FontWeight.w600,
          ),
        ),
      ),
      body: ListView.builder(
        itemCount: serverList.all.length,
        itemBuilder: (context, index) {
          final server = serverList.all[index];
          final isSelected = index == serverList.selectedIndex;
          return ListTile(
            leading: Image.asset(server.flagAsset, width: 28, height: 28),
            title: Text(server.name,
                style: TextStyle(
                  color: isSelected ? AppColors.accent : AppColors.textWhite,
                  fontWeight: FontWeight.w600,
                )),
            trailing: isSelected
                ? const Icon(Icons.check, color: AppColors.accent)
                : null,
            onTap: () {
              serverList.select(index);
              Navigator.of(context).pop();
            },
            contentPadding:
                const EdgeInsets.symmetric(horizontal: 20, vertical: 8),
          );
        },
      ),
    );
  }
 }
@@ -0,0 +1,107 @@
 import 'package:flutter/material.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/power_settings.dart';
 /// Keeping the tunnel alive is an OS concern, not an app one.
 ///
 /// Android stops background services of apps that are not exempt from Doze, and
 /// removes the whole process group when its task is swiped away. There are
 /// exactly two sanctioned ways around that, both requiring one user tap, and
 /// neither can be enabled programmatically. This tile surfaces both.
 class BackgroundReliabilityTile extends StatefulWidget {
  const BackgroundReliabilityTile({super.key});
  @override
  State<BackgroundReliabilityTile> createState() =>
      _BackgroundReliabilityTileState();
 }
 class _BackgroundReliabilityTileState extends State<BackgroundReliabilityTile>
    with WidgetsBindingObserver {
  bool? _batteryExempt;
  @override
  void initState() {
    super.initState();
    WidgetsBinding.instance.addObserver(this);
    _refresh();
  }
  @override
  void dispose() {
    WidgetsBinding.instance.removeObserver(this);
    super.dispose();
  }
  @override
  void didChangeAppLifecycleState(AppLifecycleState state) {
    // The exemption is granted in a system dialog, so the only reliable moment
    // to re-read it is when we come back to the foreground.
    if (state == AppLifecycleState.resumed) _refresh();
  }
  Future<void> _refresh() async {
    final exempt = await PowerSettings.isBatteryOptimisationDisabled();
    if (mounted) setState(() => _batteryExempt = exempt);
  }
  Future<void> _requestExemption() async {
    final opened = await PowerSettings.requestDisableBatteryOptimisation();
    if (!mounted || opened) return;
    ScaffoldMessenger.of(context).showSnackBar(
      const SnackBar(
        content: Text('Could not open battery settings on this device.'),
      ),
    );
  }
  @override
  Widget build(BuildContext context) {
    final exempt = _batteryExempt;
    return Column(
      crossAxisAlignment: CrossAxisAlignment.stretch,
      children: [
        const ListTile(
          title: Text(
            'Background reliability',
            style: TextStyle(color: AppColors.textWhite, fontSize: 15),
          ),
          subtitle: Text(
            'Android stops background apps to save power. Disabling battery '
            'optimisation is what keeps the VPN running when the app is closed.',
            style: TextStyle(color: AppColors.textDim, fontSize: 12),
          ),
        ),
        Padding(
          padding: const EdgeInsets.fromLTRB(20, 0, 20, 8),
          child: Column(
            crossAxisAlignment: CrossAxisAlignment.start,
            children: [
              Text(
                exempt == null
                    ? 'Battery optimisation: checking…'
                    : exempt
                        ? 'Battery optimisation: disabled for Revolt VPN ✓'
                        : 'Battery optimisation: still active — the system may '
                            'stop the VPN in the background.',
                style: TextStyle(
                  color: exempt == true ? AppColors.accent : AppColors.textMuted,
                  fontSize: 12,
                ),
              ),
              if (exempt == false) ...[
                const SizedBox(height: 8),
                OutlinedButton.icon(
                  onPressed: _requestExemption,
                  icon: const Icon(Icons.battery_saver),
                  label: const Text('Allow background activity'),
                ),
              ],
            ],
          ),
        ),
      ],
    );
  }
 }
@@ -0,0 +1,300 @@
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
 import 'package:revoltvpn/logic/ad_manager.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/logic/connection_settings.dart';
 import 'package:revoltvpn/logic/local_socks_tester.dart';
 import 'package:revoltvpn/logic/session_timer.dart';
 import 'package:revoltvpn/logic/vpn_connection.dart';
 class ConnectionModeTile extends StatefulWidget {
  final ValueChanged<ConnectionMode>? onChanged;
  const ConnectionModeTile({super.key, this.onChanged});
  @override
  State<ConnectionModeTile> createState() => _ConnectionModeTileState();
 }
 class _ConnectionModeTileState extends State<ConnectionModeTile> {
  ConnectionMode _mode = ConnectionSettings.mode;
  bool _testingLocalSocks = false;
  bool _reconnecting = false;
  LocalSocksTestResult? _lastSocksTest;
  @override
  void initState() {
    super.initState();
    _load();
  }
  Future<void> _load() async {
    await ConnectionSettings.initialize();
    if (mounted) setState(() => _mode = ConnectionSettings.mode);
  }
  bool _isTunnelBusy(VpnStatus status) {
    return status == VpnStatus.connected ||
        status == VpnStatus.connecting ||
        status == VpnStatus.disconnecting;
  }
  Future<void> _changeMode(ConnectionMode? next) async {
    if (next == null || next == _mode) return;
    final vpn = context.read<VpnConnection>();
    if (_isTunnelBusy(vpn.status)) {
      ScaffoldMessenger.of(context).showSnackBar(
        const SnackBar(
          content: Text('Disconnect before changing connection mode.'),
        ),
      );
      return;
    }
    final saved = await ConnectionSettings.setMode(next);
    if (!mounted) return;
    if (!saved) {
      ScaffoldMessenger.of(context).showSnackBar(
        const SnackBar(content: Text('Could not save connection mode.')),
      );
      return;
    }
    setState(() {
      _mode = next;
      _lastSocksTest = null;
    });
    widget.onChanged?.call(next);
  }
  // Recovers an orphaned proxy by ending the session and starting a new one,
  // exactly as the connect button does. Re-attaching to the session already
  // held was the one place a session began without an ad and without a nonce
  // to bind it to; a fresh one is the same path everywhere and hands back a
  // full window rather than the remainder of a broken one.
  Future<void> _reconnect() async {
    if (_reconnecting) return;
    final vpn = context.read<VpnConnection>();
    final timer = context.read<SessionTimer>();
    final ad = context.read<AdManager>();
    setState(() => _reconnecting = true);
    try {
      await timer.disconnect();
      if (!mounted) return;
      final adNonce = await ad.showAd('main');
      if (adNonce == null && AdManager.adsEnabled) return;
      if (!mounted) return;
      if (await vpn.connect(adNonce: adNonce)) {
        if (!mounted) return;
        await timer.start();
      }
    } finally {
      if (mounted) {
        setState(() {
          _reconnecting = false;
          _lastSocksTest = null;
        });
      }
    }
  }
  Future<void> _testLocalSocks() async {
    if (_testingLocalSocks) return;
    final vpn = context.read<VpnConnection>();
    if (vpn.status != VpnStatus.connected || !vpn.canTestActiveLocalSocks) {
      final orphaned =
          vpn.status == VpnStatus.connected && vpn.adoptedRunningRuntime;
      ScaffoldMessenger.of(context).showSnackBar(
        SnackBar(
          content: Text(
            orphaned
                ? 'Credentials were lost when the app restarted. Reconnect first.'
                : 'Connect with SOCKS5 first, then run the local test.',
          ),
        ),
      );
      return;
    }
    setState(() => _testingLocalSocks = true);
    final result = await vpn.testActiveLocalSocks();
    if (!mounted) return;
    setState(() {
      _testingLocalSocks = false;
      _lastSocksTest = result;
    });
    final latency = result.latencyMs == null ? '' : ' (${result.latencyMs} ms)';
    ScaffoldMessenger.of(context).showSnackBar(
      SnackBar(content: Text('${result.message}$latency')),
    );
  }
  String get _subtitle {
    switch (_mode) {
      case ConnectionMode.tun:
        return 'TUN: Android VPN routing for normal device traffic.';
      case ConnectionMode.proxy:
        return 'SOCKS5: local authenticated proxy — point apps at 127.0.0.1:<port> with the credentials shown below.';
    }
  }
  @override
  Widget build(BuildContext context) {
    return Column(
      crossAxisAlignment: CrossAxisAlignment.stretch,
      children: [
        ListTile(
          title: const Text(
            'Connection mode',
            style: TextStyle(color: AppColors.textWhite, fontSize: 15),
          ),
          subtitle: Text(
            _subtitle,
            style: const TextStyle(color: AppColors.textDim, fontSize: 12),
          ),
          trailing: DropdownButtonHideUnderline(
            child: DropdownButton<ConnectionMode>(
              value: _mode,
              dropdownColor: AppColors.bgCard,
              onChanged: _changeMode,
              items: const [
                DropdownMenuItem(
                  value: ConnectionMode.tun,
                  child: Text('TUN'),
                ),
                DropdownMenuItem(
                  value: ConnectionMode.proxy,
                  child: Text('SOCKS5'),
                ),
              ],
            ),
          ),
        ),
        if (_mode == ConnectionMode.proxy) ...[
          Consumer<VpnConnection>(
            builder: (context, vpn, _) {
              final session = vpn.activeSocksSession;
              if (session == null) {
                // The proxy can be running while this session is unknown:
                // Android killed the app process, the foreground service kept
                // the listener alive, and its credentials existed only in the
                // memory that died with it. Saying "Connect" there would be a
                // lie — the user is already connected.
                final orphaned = vpn.status == VpnStatus.connected &&
                    vpn.adoptedRunningRuntime;
                if (orphaned) {
                  return Padding(
                    padding: const EdgeInsets.fromLTRB(20, 0, 20, 8),
                    child: Column(
                      crossAxisAlignment: CrossAxisAlignment.start,
                      children: [
                        const Text(
                          'The proxy is still running, but its credentials were '
                          'lost when the app restarted. Reconnect to get a new '
                          'endpoint.',
                          style: TextStyle(
                            color: AppColors.textMuted,
                            fontSize: 12,
                          ),
                        ),
                        const SizedBox(height: 8),
                        OutlinedButton.icon(
                          onPressed: _reconnecting ? null : _reconnect,
                          icon: _reconnecting
                              ? const SizedBox(
                                  width: 16,
                                  height: 16,
                                  child: CircularProgressIndicator(
                                    strokeWidth: 2,
                                  ),
                                )
                              : const Icon(Icons.refresh),
                          label: Text(
                            _reconnecting ? 'Reconnecting…' : 'Reconnect',
                          ),
                        ),
                      ],
                    ),
                  );
                }
                return const Padding(
                  padding: EdgeInsets.fromLTRB(20, 0, 20, 8),
                  child: Text(
                    'Connect to start a local SOCKS5 proxy. Credentials change every session.',
                    style: TextStyle(color: AppColors.textMuted, fontSize: 12),
                  ),
                );
              }
              return Padding(
                padding: const EdgeInsets.fromLTRB(20, 0, 20, 8),
                child: Column(
                  crossAxisAlignment: CrossAxisAlignment.start,
                  children: [
                    Text(
                      'Proxy: 127.0.0.1:${session.port}',
                      style: const TextStyle(
                        color: AppColors.textMuted,
                        fontSize: 12,
                        fontFamily: 'monospace',
                      ),
                    ),
                    Text(
                      'Username: ${session.username}',
                      style: const TextStyle(
                        color: AppColors.textMuted,
                        fontSize: 12,
                        fontFamily: 'monospace',
                      ),
                    ),
                    Text(
                      'Password: ${session.password}',
                      style: const TextStyle(
                        color: AppColors.textMuted,
                        fontSize: 12,
                        fontFamily: 'monospace',
                      ),
                    ),
                  ],
                ),
              );
            },
          ),
          Padding(
            padding: const EdgeInsets.fromLTRB(20, 0, 20, 8),
            child: OutlinedButton.icon(
              onPressed: _testingLocalSocks ? null : _testLocalSocks,
              icon: _testingLocalSocks
                  ? const SizedBox(
                      width: 16,
                      height: 16,
                      child: CircularProgressIndicator(strokeWidth: 2),
                    )
                  : const Icon(Icons.network_check),
              label: Text(
                _testingLocalSocks ? 'Testing…' : 'Test Local SOCKS',
              ),
            ),
          ),
          if (_lastSocksTest != null)
            Padding(
              padding: const EdgeInsets.fromLTRB(20, 0, 20, 12),
              child: Text(
                _lastSocksTest!.ok
                    ? 'Last test: OK${_lastSocksTest!.latencyMs == null ? '' : ' · ${_lastSocksTest!.latencyMs} ms'}'
                    : 'Last test: Failed · ${_lastSocksTest!.message}',
                style: const TextStyle(
                  color: AppColors.textMuted,
                  fontSize: 12,
                ),
              ),
            ),
        ],
      ],
    );
  }
 }
@@ -1,8 +1,6 @@
 import 'package:flutter/material.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
-
+import 'package:revoltvpn/logic/haptic_settings.dart';
 bool hapticEnabled = false;
 class HapticFeedbackTile extends StatefulWidget {
  const HapticFeedbackTile({super.key});
@@ -12,7 +10,8 @@ class HapticFeedbackTile extends StatefulWidget {
 }
 class _HapticFeedbackTileState extends State<HapticFeedbackTile> {
-  bool _on = false;
+  bool _on = HapticSettings.enabled;
  bool _saving = false;
  @override
  void initState() {
@@ -20,21 +19,25 @@ class _HapticFeedbackTileState extends State<HapticFeedbackTile> {
    _load();
  }
  // Loads persisted state and syncs the top-level bool.
  Future<void> _load() async {
-    final prefs = await SharedPreferences.getInstance();
+    await HapticSettings.initialize();
-    final value = prefs.getBool('haptic_feedback_enabled') ?? false;
+    if (mounted) setState(() => _on = HapticSettings.enabled);
    hapticEnabled = value;
    if (mounted) setState(() => _on = value);
  }
  // Writes to SharedPreferences AND updates the live bool so the connect
  // button sees the change immediately — no restart needed.
  Future<void> _toggle(bool value) async {
-    final prefs = await SharedPreferences.getInstance();
+    if (_saving) return;
-    await prefs.setBool('haptic_feedback_enabled', value);
+    setState(() {
-    hapticEnabled = value;
+      _saving = true;
-    setState(() => _on = value);
+      _on = value;
    });
    try {
      await HapticSettings.setEnabled(value);
    } catch (_) {
      if (mounted) setState(() => _on = HapticSettings.enabled);
    } finally {
      if (mounted) setState(() => _saving = false);
    }
  }
  @override
@@ -45,7 +48,7 @@ class _HapticFeedbackTileState extends State<HapticFeedbackTile> {
        style: TextStyle(color: AppColors.textWhite, fontSize: 15),
      ),
      value: _on,
-      onChanged: _toggle,
+      onChanged: _saving ? null : _toggle,
      activeTrackColor: AppColors.accent.withAlpha(80),
      activeThumbColor: AppColors.accent,
      contentPadding: const EdgeInsets.symmetric(horizontal: 20, vertical: 4),
@@ -4,12 +4,13 @@ import 'package:revoltvpn/logic/app_colors.dart';
 // ── lib/screens/settings/in_settings/lightning.dart ─────────────────────────
 // Toggle for the lightning strike overlay on the main screen.
 //
 // Same architecture as haptic.dart: exports a top-level bool read synchronously
 // by lib/components/lightning.dart. Default: true (lightning is on — opt-out).
-// lib/components/lightning.dart reads this in its build method.
+final ValueNotifier<bool> lightningEnabled = ValueNotifier(true);
-bool lightningEnabled = true;
+
 Future<void> loadLightningPref() async {
  final prefs = await SharedPreferences.getInstance();
  lightningEnabled.value = prefs.getBool('lightning_effect_enabled') ?? true;
 }
 class LightningToggleTile extends StatefulWidget {
  const LightningToggleTile({super.key});
@@ -28,16 +29,14 @@ class _LightningToggleTileState extends State<LightningToggleTile> {
  }
  Future<void> _load() async {
-    final prefs = await SharedPreferences.getInstance();
+    await loadLightningPref();
-    final value = prefs.getBool('lightning_effect_enabled') ?? true;
+    if (mounted) setState(() => _on = lightningEnabled.value);
    lightningEnabled = value;
    if (mounted) setState(() => _on = value);
  }
  Future<void> _toggle(bool value) async {
    final prefs = await SharedPreferences.getInstance();
    await prefs.setBool('lightning_effect_enabled', value);
-    lightningEnabled = value;
+    lightningEnabled.value = value;
    setState(() => _on = value);
  }
@@ -4,12 +4,13 @@ import 'package:revoltvpn/logic/app_colors.dart';
 // ── lib/screens/settings/in_settings/rain.dart ──────────────────────────────
 // Toggle for the animated rain overlay on the main screen.
 //
 // Same architecture as haptic.dart: exports a top-level bool read synchronously
 // by lib/components/rain.dart. Default: true (rain is on — opt-out).
-// lib/components/rain.dart reads this in its build method.
+final ValueNotifier<bool> rainEnabled = ValueNotifier(true);
-bool rainEnabled = true;
+
 Future<void> loadRainPref() async {
  final prefs = await SharedPreferences.getInstance();
  rainEnabled.value = prefs.getBool('rain_effect_enabled') ?? true;
 }
 class RainToggleTile extends StatefulWidget {
  const RainToggleTile({super.key});
@@ -28,16 +29,14 @@ class _RainToggleTileState extends State<RainToggleTile> {
  }
  Future<void> _load() async {
-    final prefs = await SharedPreferences.getInstance();
+    await loadRainPref();
-    final value = prefs.getBool('rain_effect_enabled') ?? true;
+    if (mounted) setState(() => _on = rainEnabled.value);
    rainEnabled = value;
    if (mounted) setState(() => _on = value);
  }
  Future<void> _toggle(bool value) async {
    final prefs = await SharedPreferences.getInstance();
    await prefs.setBool('rain_effect_enabled', value);
-    rainEnabled = value;
+    rainEnabled.value = value;
    setState(() => _on = value);
  }
@@ -1,23 +1,10 @@
 import 'package:flutter/material.dart';
 import 'package:revoltvpn/logic/app_colors.dart';
 import 'package:revoltvpn/screens/settings/in_settings/background_reliability.dart';
 import 'package:revoltvpn/screens/settings/in_settings/connection_mode.dart';
 import 'package:revoltvpn/screens/settings/in_settings/haptic.dart';
 import 'package:revoltvpn/screens/settings/in_settings/rain.dart';
 import 'package:revoltvpn/screens/settings/in_settings/lightning.dart';
-
+import 'package:revoltvpn/screens/settings/in_settings/rain.dart';
 // ── lib/screens/settings/settings_screen.dart ────────────────────────────────
 // Settings shell — full-screen page reached from the sidebar.
 //
 // Folder layout:
 //   lib/screens/settings/       ← this folder: settings family
 //     settings_screen.dart      ← shell: Scaffold + AppBar + ListView (this file)
 //     *_tile.dart               ← one file per setting feature (add below)
 //   lib/components/sidebar_contents/
 //     settings.dart             ← thin sidebar row that navigates here
 //
 // To add a setting:
 //   1. Create a new file in this folder, e.g. appearance_tile.dart
 //   2. Import it below
 //   3. Append it to the children list
 class SettingsScreen extends StatelessWidget {
  const SettingsScreen({super.key});
@@ -44,11 +31,11 @@ class SettingsScreen extends StatelessWidget {
      body: ListView(
        padding: const EdgeInsets.symmetric(vertical: 8),
        children: const [
          ConnectionModeTile(),
          BackgroundReliabilityTile(),
          HapticFeedbackTile(),
          RainToggleTile(),
          LightningToggleTile(),
          // ── Add setting tiles here ────────────────────────────────────────
          // Each tile imports from its own file in this folder.
        ],
      ),
    );
@@ -0,0 +1,30 @@
 # This file tracks properties of this Flutter project.
 # Used by Flutter tool to assess capabilities and perform upgrades etc.
 #
 # This file should be version controlled and should not be manually edited.
 version:
  revision: "adc901062556672b4138e18a4dc62a4be8f4b3c2"
  channel: "stable"
 project_type: plugin
 # Tracks metadata for the flutter migrate command
 migration:
  platforms:
    - platform: root
      create_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
      base_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
    - platform: android
      create_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
      base_revision: adc901062556672b4138e18a4dc62a4be8f4b3c2
  # User provided section
  # List of Local paths (relative to this file) that should be
  # ignored by the migrate tool.
  #
  # Files that are not part of the templates will be ignored by default.
  unmanaged_files:
    - 'lib/main.dart'
    - 'ios/Runner.xcodeproj/project.pbxproj'
@@ -0,0 +1,49 @@
 ## 1.1.5
 * Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.7.11`.
 * Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.7.11`.
 * Fixed Android VPN app routing: all configured blocked apps are now applied to `VpnService.Builder` as disallowed applications and bypass the Xray VPN tunnel.
 ## 1.1.4
 * Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.6.27.1`.
 * Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.6.27`.
 ## 1.1.3
 * Updated the Android runtime dependency to `dev.tfox.fluttervless:xray-android:26.6.22`.
 * Rebuilt Android `libxray.so` binaries for `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64` against Xray-core `v26.6.22`.
 ## 1.1.2
 * Clarified that Android device and emulator runtime binaries are delivered through the main Maven `xray-android` AAR.
 * Kept the Android runtime dependency on `dev.tfox.fluttervless:xray-android:26.6.1.1`.
 ## 1.1.1
 * Updated the Android device runtime `libxray.so` binaries to Xray-core `v26.6.1`.
 * Kept Android 15+ 16KB page-size linker alignment for the rebuilt ARM binaries.
 * Moved Android runtime binaries and geodata into the Maven `dev.tfox.fluttervless:xray-android:26.6.1.1` AAR dependency.
 * Included device and emulator ABIs (`armeabi-v7a`, `arm64-v8a`, `x86`, `x86_64`) in the main Maven runtime AAR.
 * Removed raw device `jniLibs` and geodata files from the Pub.dev wrapper package; the wrapper now resolves the runtime from Maven Central.
 ## 1.1.0
 * Replaced Android Dart boilerplate with the shared `VlessMethodChannelAdapter`.
 * Removed template `getPlatformVersion` scaffold files.
 * Moved `flutter_lints` to `dev_dependencies`.
 * Removed publish-time dependency overrides from `pubspec.yaml`.
 ## 1.0.2
 * XRay version up
 ## 1.0.1
 *   XRay version up
 ## 1.0.0
 *   Initial release of the Android implementation for `flutter_vless`.
 *   Supports VLESS/VMESS protocols using Xray core.
 *   Implements `VlessPlatform` interface.
@@ -0,0 +1,21 @@
 MIT License
 Copyright (c) 2024-2026 13FOX Studio / tfox.dev
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
@@ -0,0 +1,13 @@
 flutter_vless_android
 Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
 This package is the Android implementation of the official flutter_vless
 project maintained by 13FOX Studio.
 Official project: https://github.com/XIIIFOX/flutter_vless
 Official publisher: https://pub.dev/publishers/tfox.dev
 Website: https://tfox.dev
 Redistributions, forks, and derived packages must preserve the copyright notice
 and MIT license notice where required by the license.
@@ -0,0 +1,14 @@
 # flutter_vless_android
 The Android implementation of the `flutter_vless` plugin.
 ## Runtime
 Android runtime binaries and geodata are delivered through the Maven Central AAR dependency `dev.tfox.fluttervless:xray-android:26.7.11`. This keeps the Pub.dev package lightweight while preserving the same packaged Xray files in the final Android app.
 Do not add raw `android/src/main/jniLibs` or geodata files back to this package. Rebuild runtime files in `android_runtime/xray_android/src/main`, publish the Maven AAR, then publish this wrapper package.
 ## Emulator Support
 The current Maven runtime AAR includes `armeabi-v7a`, `arm64-v8a`, `x86`, and `x86_64`.
 This covers both physical Android devices and Android emulators.
@@ -0,0 +1,4 @@
 Upstream: https://github.com/XIIIFOX/flutter_vless
 Tag: v1.1.5
 Android package: flutter_vless_android 1.1.5
 ReVolt hardening is pre-applied to this vendored package.
@@ -0,0 +1,4 @@
 include: package:flutter_lints/flutter.yaml
 # Additional information about this file can be found at
 # https://dart.dev/guides/language/analysis-options
@@ -0,0 +1,9 @@
 *.iml
 .gradle
 /local.properties
 /.idea/workspace.xml
 /.idea/libraries
 .DS_Store
 /build
 /captures
 .cxx
@@ -0,0 +1,92 @@
 # Xray & Tun2socks Android Build Guide
 This guide explains how to build the native libraries (`libxray.so` and `libtun2socks.so`) for the Flutter Vless plugin.
 Android runtime files are stored in `android_runtime/xray_android/src/main` and published as the Maven Central AAR `dev.tfox.fluttervless:xray-android`. They are not stored in the `flutter_vless_android` Pub.dev package.
 **Key Features:**
 - ✅ **Android 15+ Support**: Builds with 16KB page size alignment.
 - ✅ **Socket FD Passing**: `tun2socks` is patched to receive the TUN file descriptor via a Unix socket (bypassing Android process restrictions).
 ## Prerequisites
 1. **Go (Golang)**: Version 1.21+ installed.
 2. **Android NDK**: Version r27+ (recommended).
 3. **macOS/Linux**: Build scripts are designed for Unix-like environments.
 ## 1. Environment Setup
 Export the path to your Android NDK.
 ```bash
 # Example (Adjust path to your NDK installation)
 export ANDROID_NDK_HOME="$HOME/Library/Android/sdk/ndk/27.0.12077973"
 ```
 ## 2. Build Xray (`libxray.so`)
 This script builds the Xray core for Android device and emulator architectures (`arm64-v8a`, `armeabi-v7a`, `x86`, `x86_64`) by default and writes them to the Maven runtime module.
 ```bash
 cd android
 chmod +x build_xray.sh
 ./build_xray.sh
 ```
 ## 3. Build Tun2socks (`libtun2socks.so`)
 We use a custom Go-based build script (`build_tun2socks.sh`) instead of the old C-based one. This ensures 16KB page alignment and includes the socket-based FD passing logic.
 ```bash
 cd android
 chmod +x build_tun2socks.sh
 ./build_tun2socks.sh
 ```
 ## 4. Verification (16KB Page Size)
 To confirm that the libraries are compatible with Android 15+ (16KB page size), check the `LOAD` segment alignment using `llvm-readelf`.
 ```bash
 # Check alignment (should be 0x4000)
 $ANDROID_NDK_HOME/toolchains/llvm/prebuilt/darwin-x86_64/bin/llvm-readelf -l ../../../android_runtime/xray_android/src/main/jniLibs/arm64-v8a/libtun2socks.so | grep LOAD | head -1
 ```
 **Expected Output:**
 ```
 LOAD           ... 0x4000
 ```
 If you see `0x1000`, it is **NOT** compatible with 16KB devices.
 ## 5. Package The Maven Runtime AAR
 The `flutter_vless_android` Pub.dev package consumes the Android device runtime through the Maven artifact:
 ```text
 dev.tfox.fluttervless:xray-android:26.7.11
 ```
 After rebuilding `libxray.so`, `libtun2socks.so`, or the geodata files in `android_runtime/xray_android/src/main`, build the local Maven repository from the repository root:
 ```bash
 tool/build_android_runtime_maven.sh
 ```
 For local Android wrapper or example builds before Maven Central publication, pass the local repository path:
 ```bash
 cd example/android
 ./gradlew :app:assembleDebug \
  -PflutterVlessAndroidRuntimeRepo="$PWD/../../android_runtime/xray_android/build/repo"
 ```
 To upload the signed bundle to Maven Central, configure the Central Portal and signing environment variables documented in `android_runtime/xray_android/README.md`, then run:
 ```bash
 tool/publish_android_runtime_maven.sh
 ```
 ## 6. Troubleshooting
 - **"bad file descriptor"**: This means the socket FD passing failed. Ensure `XrayVPNService.kt` is correctly sending the FD to the socket path specified in `-sock-path`.
 - **"permission denied"**: Ensure the app has permissions to write to the socket file in its private directory.
@@ -0,0 +1,95 @@
 group 'com.github.tfox.flutter_vless'
 version '1.0'
 buildscript {
    ext.kotlin_version = '2.2.20'
    repositories {
        google()
        mavenCentral()
    }
    dependencies {
        classpath 'com.android.tools.build:gradle:8.1.0'
        classpath "org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlin_version"
    }
 }
 rootProject.allprojects {
    repositories {
        def localRuntimeRepo = findProperty('flutterVlessAndroidRuntimeRepo') ?: System.getenv('FLUTTER_VLESS_ANDROID_RUNTIME_REPO')
        if (localRuntimeRepo) {
            maven { url uri(localRuntimeRepo) }
        }
        google()
        mavenCentral()
    }
 }
 apply plugin: 'com.android.library'
 apply plugin: 'kotlin-android'
 android {
    if (project.android.hasProperty("namespace")) {
        namespace 'com.github.tfox.flutter_vless'
    }
    compileSdkVersion 34
    compileOptions {
        sourceCompatibility JavaVersion.VERSION_1_8
        targetCompatibility JavaVersion.VERSION_1_8
    }
    kotlinOptions {
        jvmTarget = '1.8'
    }
    defaultConfig {
        minSdkVersion 23
        targetSdkVersion 35
        // 16KB page size support for Android 15+
        ndk {
            abiFilters 'armeabi-v7a', 'arm64-v8a', 'x86', 'x86_64'
        }
    }
    // Configure 16KB page alignment
    buildFeatures {
        prefab true
    }
    dependencies {
        testImplementation 'junit:junit:4.13.2'
        testImplementation 'org.mockito:mockito-core:5.0.0'
        testImplementation 'org.json:json:20240303'
    }
    testOptions {
        unitTests.returnDefaultValues = true
        unitTests.all {
            testLogging {
               events "passed", "skipped", "failed", "standardOut", "standardError"
               outputs.upToDateWhen {false}
               showStandardStreams = true
            }
        }
    }
    sourceSets {
        main {
            java.srcDirs += 'src/main/kotlin'
        }
    }
    packaging {
        jniLibs {
            pickFirsts += ['lib/**/libc++_shared.so']
        }
    }
 }
 dependencies {
    implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
    implementation 'androidx.appcompat:appcompat:1.6.1'
    implementation 'com.google.code.gson:gson:2.10.1'
    implementation "dev.tfox.fluttervless:xray-android:${findProperty('flutterVlessXrayRuntimeVersion') ?: '26.7.11'}"
 }
@@ -0,0 +1,122 @@
 #!/bin/bash
 set -euo pipefail
 # Build script for tun2socks (Go version) with 16KB page size support
 # This is required for Android 15+ compatibility
 # Configuration
 TUN2SOCKS_REPO="https://github.com/xjasonlyu/tun2socks"
 TARGET_DIR="${TARGET_DIR:-../../../android_runtime/xray_android/src/main/jniLibs}"
 NDK_PATH="${ANDROID_NDK_HOME:-$HOME/Library/Android/sdk/ndk/28.2.13676358}"
 # Check NDK
 if [ ! -d "$NDK_PATH" ]; then
    echo "Error: NDK not found at $NDK_PATH"
    echo "Please export ANDROID_NDK_HOME pointing to your NDK installation."
    exit 1
 fi
 echo "Using NDK at: $NDK_PATH"
 case "$(uname -s)" in
    Darwin) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/darwin-x86_64" ;;
    Linux) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64" ;;
    *) echo "Error: unsupported host OS $(uname -s)"; exit 1 ;;
 esac
 if [ ! -d "$TOOLCHAIN" ]; then
    echo "Error: NDK toolchain not found at $TOOLCHAIN"
    echo "Please check ANDROID_NDK_HOME and host OS."
    exit 1
 fi
 # Clone tun2socks if not exists
 if [ ! -d "tun2socks-go" ]; then
    echo "Cloning tun2socks (Go version)..."
    git clone "$TUN2SOCKS_REPO" tun2socks-go
 else
    echo "tun2socks-go directory exists, pulling latest..."
    cd tun2socks-go && git pull && cd ..
 fi
 # Build Function
 build_tun2socks() {
    local ARCH_NAME=$1
    local GO_ARCH=$2
    local GO_ARM=$3
    local ANDROID_TARGET=$4
    local OUTPUT_DIR="${TARGET_DIR}/${ARCH_NAME}"
    echo "Building tun2socks for ${ARCH_NAME}..."
    mkdir -p "$OUTPUT_DIR"
    export CGO_ENABLED=1
    export GOOS=android
    export GOARCH=$GO_ARCH
    export GOARM=$GO_ARM
    export CC="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang"
    export CXX="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang++"
    # Verify compiler exists
    if [ ! -f "$CC" ]; then
        echo "Error: Compiler not found at $CC"
        return 1
    fi
    cd tun2socks-go
    # Build with 16KB page alignment - same flags as xray
    go build -v -trimpath -ldflags "-s -w -buildid= -linkmode=external -extldflags '-Wl,-z,max-page-size=16384'" -buildmode=pie -o "../${OUTPUT_DIR}/libtun2socks.so" .
    echo "Success: ${OUTPUT_DIR}/libtun2socks.so created."
    # Verify 16KB alignment
    if [ -x "${TOOLCHAIN}/bin/llvm-readelf" ]; then
        echo "Verifying 16KB alignment:"
        ALIGN=$("${TOOLCHAIN}/bin/llvm-readelf" -l "../${OUTPUT_DIR}/libtun2socks.so" | grep "LOAD" | head -1 | awk '{print $NF}')
        if [ "$ALIGN" = "0x4000" ]; then
            echo "Alignment: $ALIGN (16KB) - correct"
        else
            echo "Warning: alignment is $ALIGN; expected 0x4000"
        fi
    fi
    cd ..
 }
 # Build for Architectures
 echo "Building tun2socks (Go version) with 16KB page size support..."
 # ARM64
 if [ "${TUN2SOCKS_BUILD_ARM64:-1}" = "1" ]; then
    build_tun2socks "arm64-v8a" "arm64" "" "aarch64-linux-android21"
 fi
 # ARMv7
 if [ "${TUN2SOCKS_BUILD_ARMV7:-1}" = "1" ]; then
    build_tun2socks "armeabi-v7a" "arm" "7" "armv7a-linux-androideabi21"
 fi
 # x86 is included in the main runtime AAR.
 if [ "${TUN2SOCKS_BUILD_X86:-1}" = "1" ]; then
    build_tun2socks "x86" "386" "" "i686-linux-android21"
 fi
 # x86_64 is included in the main runtime AAR.
 if [ "${TUN2SOCKS_BUILD_X86_64:-1}" = "1" ]; then
    build_tun2socks "x86_64" "amd64" "" "x86_64-linux-android21"
 fi
 echo ""
 echo "========================================="
 echo "Build process finished!"
 echo "========================================="
 echo ""
 echo "Verification:"
 echo "Run this command to check all libraries:"
 echo ""
 echo "for arch in armeabi-v7a arm64-v8a x86 x86_64; do"
 echo "  echo \"=== \$arch ===\";"
 echo "  ${TOOLCHAIN}/bin/llvm-readelf -l ${TARGET_DIR}/\$arch/libtun2socks.so | grep LOAD | head -1;"
 echo "done"
@@ -0,0 +1,116 @@
 #!/bin/bash
 set -euo pipefail
 # Configuration
 XRAY_REPO="https://github.com/XTLS/Xray-core"
 XRAY_VERSION="${XRAY_VERSION:-v26.7.11}"
 TARGET_DIR="${TARGET_DIR:-../../../android_runtime/xray_android/src/main/jniLibs}"
 NDK_PATH="${ANDROID_NDK_HOME:-$HOME/Library/Android/sdk/ndk/28.2.13676358}"
 # Check NDK
 if [ ! -d "$NDK_PATH" ]; then
    echo "Error: NDK not found at $NDK_PATH"
    echo "Please export ANDROID_NDK_HOME pointing to your NDK installation."
    exit 1
 fi
 echo "Using NDK at: $NDK_PATH"
 # MacOS NDK Toolchain path
 case "$(uname -s)" in
    Darwin) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/darwin-x86_64" ;;
    Linux) TOOLCHAIN="${NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64" ;;
    *) echo "Error: unsupported host OS $(uname -s)"; exit 1 ;;
 esac
 if [ ! -d "$TOOLCHAIN" ]; then
    echo "Error: NDK toolchain not found at $TOOLCHAIN"
    echo "Are you on macOS? If not, please edit the script to match your OS."
    exit 1
 fi
 # Clone Xray if not exists
 if [ ! -d "Xray-core" ]; then
    echo "Cloning Xray-core..."
    git clone "$XRAY_REPO"
 else
    echo "Xray-core directory exists, pulling latest..."
    cd Xray-core && git fetch --tags && cd ..
 fi
 cd Xray-core
 git fetch --tags
 git checkout "$XRAY_VERSION"
 cd ..
 # Build Function
 build_xray() {
    local ARCH_NAME=$1
    local GO_ARCH=$2
    local GO_ARM=$3
    local ANDROID_TARGET=$4
    local OUTPUT_DIR="${TARGET_DIR}/${ARCH_NAME}"
    echo "Building for ${ARCH_NAME}..."
    mkdir -p "$OUTPUT_DIR"
    export CGO_ENABLED=1
    export GOOS=android
    export GOARCH=$GO_ARCH
    export GOARM=$GO_ARM
    export CC="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang"
    export CXX="${TOOLCHAIN}/bin/${ANDROID_TARGET}-clang++"
    # 16KB page size support for Android 15+
    export LDFLAGS="-Wl,-z,max-page-size=16384"
    # Verify compiler exists
    if [ ! -f "$CC" ]; then
        echo "Error: Compiler not found at $CC"
        # Try older NDK naming convention if new one fails (API 21 is standard)
        # Some NDKs use specific API levels in clang name
        return 1
    fi
    cd Xray-core
    # Build with 16KB page alignment
    if go build -v -trimpath -buildvcs=false \
        -gcflags "all=-l=4" \
        -ldflags "-X github.com/xtls/xray-core/core.build=${XRAY_VERSION} -s -w -buildid= -checklinkname=0 -linkmode=external -extldflags=${LDFLAGS}" \
        -buildmode=pie \
        -o "../${OUTPUT_DIR}/libxray.so" ./main; then
        echo "Success: ${OUTPUT_DIR}/libxray.so created."
    else
        echo "Failed to build for ${ARCH_NAME}"
        return 1
    fi
    cd ..
 }
 # Build for Architectures
 # API Level 21 is generally safe for modern Flutter apps (Android 5.0+)
 # ARM64
 if [ "${XRAY_BUILD_ARM64:-1}" = "1" ]; then
    build_xray "arm64-v8a" "arm64" "" "aarch64-linux-android21"
 fi
 # ARMv7
 if [ "${XRAY_BUILD_ARMV7:-1}" = "1" ]; then
    build_xray "armeabi-v7a" "arm" "7" "armv7a-linux-androideabi21"
 fi
 # x86 is included in the main runtime AAR.
 if [ "${XRAY_BUILD_X86:-1}" = "1" ]; then
    build_xray "x86" "386" "" "i686-linux-android21"
 fi
 # x86_64 is included in the main runtime AAR.
 if [ "${XRAY_BUILD_X86_64:-1}" = "1" ]; then
    build_xray "x86_64" "amd64" "" "x86_64-linux-android21"
 fi
 echo "Build process finished."
@@ -0,0 +1 @@
 rootProject.name = 'flutter_vless_android'
@@ -0,0 +1,31 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.github.tfox.flutter_vless">
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
    <uses-permission
        android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE"
        android:minSdkVersion="34" />
    <application>
        <service
            android:name="com.github.tfox.flutter_vless.xray.service.XrayVPNService"
            android:enabled="true"
            android:exported="false"
            android:foregroundServiceType="specialUse"
            android:permission="android.permission.BIND_VPN_SERVICE"
            android:process=":RunSoLibXrayDaemon">
            <property
                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
                android:value="vpn" />
            <intent-filter>
                <action android:name="android.net.VpnService" />
            </intent-filter>
            <meta-data
                android:name="android.net.VpnService.SUPPORTS_ALWAYS_ON"
                android:value="false" />
        </service>
    </application>
 </manifest>
@@ -0,0 +1,424 @@
 // Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
 // SPDX-License-Identifier: MIT
 package com.github.tfox.flutter_vless
 import android.Manifest
 import android.app.Activity
 import android.content.BroadcastReceiver
 import android.content.Context
 import android.content.Intent
 import android.content.IntentFilter
 import android.content.pm.PackageManager
 import android.net.VpnService
 import android.os.Build
 import android.os.Handler
 import android.os.Looper
 import android.util.Log
 import androidx.core.app.ActivityCompat
 import androidx.core.content.ContextCompat
 import com.github.tfox.flutter_vless.xray.dto.XrayConfig
 import com.github.tfox.flutter_vless.xray.service.XrayVPNService
 import com.github.tfox.flutter_vless.xray.utils.AppConfigs
 import io.flutter.embedding.engine.plugins.FlutterPlugin
 import io.flutter.embedding.engine.plugins.activity.ActivityAware
 import io.flutter.embedding.engine.plugins.activity.ActivityPluginBinding
 import io.flutter.plugin.common.EventChannel
 import io.flutter.plugin.common.MethodCall
 import io.flutter.plugin.common.MethodChannel
 import io.flutter.plugin.common.PluginRegistry
 import java.io.BufferedReader
 import java.io.File
 import java.io.InputStreamReader
 import java.util.ArrayList
 import java.util.UUID
 import java.util.concurrent.Executors
 /**
 * Main entry point for the Flutter Vless plugin on Android.
 *
 * ReVolt keeps this bridge deliberately narrow: start/stop, session deadline,
 * permission handling, core version and private runtime status only.
 */
 class FlutterVlessPlugin : FlutterPlugin, ActivityAware, PluginRegistry.ActivityResultListener, MethodChannel.MethodCallHandler {
    private val executor = Executors.newSingleThreadExecutor()
    private lateinit var vpnControlMethod: MethodChannel
    private lateinit var vpnStatusEvent: EventChannel
    private var vpnStatusSink: EventChannel.EventSink? = null
    private var activity: Activity? = null
    private var xrayReceiver: BroadcastReceiver? = null
    private var pendingResult: MethodChannel.Result? = null
    private lateinit var context: Context
    private var expectedRuntimeToken: String? = null
    private var pendingStopResult: MethodChannel.Result? = null
    private val mainHandler = Handler(Looper.getMainLooper())
    private val stopTimeoutRunnable = Runnable {
        val pending = pendingStopResult ?: return@Runnable
        pendingStopResult = null
        pending.error("STOP_TIMEOUT", "VPN service did not confirm shutdown", null)
    }
    companion object {
        private const val TAG = "FlutterVlessPlugin"
        private const val REQUEST_CODE_VPN_PERMISSION = 24
        private const val REQUEST_CODE_POST_NOTIFICATIONS = 1
    }
    override fun onAttachedToEngine(binding: FlutterPlugin.FlutterPluginBinding) {
        context = binding.applicationContext
        vpnControlMethod = MethodChannel(binding.binaryMessenger, "flutter_vless")
        vpnStatusEvent = EventChannel(binding.binaryMessenger, "flutter_vless/status")
        vpnControlMethod.setMethodCallHandler(this)
        vpnStatusEvent.setStreamHandler(object : EventChannel.StreamHandler {
            override fun onListen(arguments: Any?, events: EventChannel.EventSink?) {
                vpnStatusSink = events
                registerReceiver()
            }
            override fun onCancel(arguments: Any?) {
                vpnStatusSink = null
                unregisterReceiver()
            }
        })
    }
    override fun onMethodCall(call: MethodCall, result: MethodChannel.Result) {
        when (call.method) {
            "startVless" -> {
                if (pendingStopResult != null) {
                    result.error("STOP_IN_PROGRESS", "VPN shutdown is still in progress", null)
                    return
                }
                val config = XrayConfig()
                val runtimeToken = UUID.randomUUID().toString()
                expectedRuntimeToken = runtimeToken
                config.RUNTIME_TOKEN = runtimeToken
                config.REMARK = call.argument("remark") ?: ""
                config.V2RAY_FULL_JSON_CONFIG = call.argument("config") ?: ""
                config.BLOCKED_APPS = call.argument<ArrayList<String>>("blocked_apps") ?: ArrayList()
                config.BYPASS_SUBNETS = call.argument<ArrayList<String>>("bypass_subnets") ?: ArrayList()
                config.NOTIFICATION_DISCONNECT_BUTTON_NAME = call.argument("notificationDisconnectButtonName") ?: "Disconnect"
                if (AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME.isNotEmpty() && AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE.isNotEmpty()) {
                    config.NOTIFICATION_ICON_RESOURCE_NAME = AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME
                    config.NOTIFICATION_ICON_RESOURCE_TYPE = AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE
                    val resId = context.resources.getIdentifier(
                        AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME,
                        AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE,
                        context.packageName
                    )
                    config.APPLICATION_ICON = resId
                }
                if (call.argument<Boolean>("proxy_only") == true) {
                    AppConfigs.V2RAY_CONNECTION_MODE = AppConfigs.V2RAY_CONNECTION_MODES.PROXY_ONLY
                } else {
                    AppConfigs.V2RAY_CONNECTION_MODE = AppConfigs.V2RAY_CONNECTION_MODES.VPN_TUN
                }
                try {
                    val jsonConfig = org.json.JSONObject(config.V2RAY_FULL_JSON_CONFIG)
                    val outbounds = jsonConfig.optJSONArray("outbounds")
                    if (outbounds != null && outbounds.length() > 0) {
                        val firstOutbound = outbounds.getJSONObject(0)
                        val settings = firstOutbound.optJSONObject("settings")
                        val vnext = settings?.optJSONArray("vnext")
                        if (vnext != null && vnext.length() > 0) {
                            val server = vnext.getJSONObject(0)
                            config.CONNECTED_V2RAY_SERVER_ADDRESS = server.optString("address", "")
                            config.CONNECTED_V2RAY_SERVER_PORT = server.optInt("port", 0).toString()
                        } else if (settings != null) {
                            config.CONNECTED_V2RAY_SERVER_ADDRESS = settings.optString("address", "")
                            config.CONNECTED_V2RAY_SERVER_PORT = settings.optInt("port", 0).toString()
                        }
                    }
                } catch (_: Exception) {
                    // Optional metadata only; runtime config validation happens downstream.
                }
                val intent = Intent(context, XrayVPNService::class.java)
                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.START_SERVICE)
                intent.putExtra("V2RAY_CONFIG", config)
                intent.putExtra("PROXY_ONLY", call.argument<Boolean>("proxy_only") ?: false)
                try {
                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
                        context.startForegroundService(intent)
                    } else {
                        context.startService(intent)
                    }
                    result.success(null)
                } catch (e: Exception) {
                    if (expectedRuntimeToken == runtimeToken) expectedRuntimeToken = null
                    result.error("START_FAILED", e.message ?: "Could not start VPN service", null)
                }
            }
            "stopVless" -> {
                if (pendingStopResult != null) {
                    result.error("STOP_IN_PROGRESS", "VPN shutdown is already in progress", null)
                    return
                }
                // A STOP without a generation token can kill a newer runtime after
                // UI/process churn. No token means this bridge owns nothing to stop.
                val token = expectedRuntimeToken
                if (token == null) {
                    result.success(null)
                    return
                }
                val intent = Intent(context, XrayVPNService::class.java)
                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
                intent.putExtra("RUNTIME_TOKEN", token)
                try {
                    context.startService(intent)
                    pendingStopResult = result
                    mainHandler.removeCallbacks(stopTimeoutRunnable)
                    mainHandler.postDelayed(stopTimeoutRunnable, 6_000L)
                } catch (e: Exception) {
                    pendingStopResult = null
                    mainHandler.removeCallbacks(stopTimeoutRunnable)
                    result.error("STOP_FAILED", e.message ?: "Could not stop VPN service", null)
                }
            }
            "setSessionDeadline" -> {
                val token = expectedRuntimeToken
                val remainingSeconds = call.argument<Number>("remainingSeconds")?.toLong()
                if (token == null) {
                    result.error("NO_RUNTIME", "No active runtime token", null)
                    return
                }
                if (remainingSeconds == null || remainingSeconds < 0) {
                    result.error("INVALID_DEADLINE", "remainingSeconds must be non-negative", null)
                    return
                }
                val intent = Intent(context, XrayVPNService::class.java)
                intent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.UPDATE_SESSION_DEADLINE)
                intent.putExtra("RUNTIME_TOKEN", token)
                intent.putExtra("REMAINING_SECONDS", remainingSeconds)
                try {
                    context.startService(intent)
                    result.success(null)
                } catch (e: Exception) {
                    result.error("DEADLINE_FAILED", e.message ?: "Could not update session deadline", null)
                }
            }
            "initializeVless" -> {
                val iconResourceName = call.argument<String>("notificationIconResourceName")
                val iconResourceType = call.argument<String>("notificationIconResourceType")
                if (iconResourceName != null && iconResourceType != null) {
                    AppConfigs.NOTIFICATION_ICON_RESOURCE_NAME = iconResourceName
                    AppConfigs.NOTIFICATION_ICON_RESOURCE_TYPE = iconResourceType
                }
                result.success(null)
            }
            "getCoreVersion" -> {
                executor.submit {
                    try {
                        val nativeLibraryDir = context.applicationInfo.nativeLibraryDir
                        val xrayExecutable = File(nativeLibraryDir, "libxray.so")
                        if (xrayExecutable.exists()) {
                            val p = Runtime.getRuntime().exec(arrayOf(xrayExecutable.absolutePath, "-version"))
                            val reader = BufferedReader(InputStreamReader(p.inputStream))
                            val version = reader.readLine()
                            result.success(version)
                        } else {
                            result.success("Xray not found")
                        }
                    } catch (e: Exception) {
                        result.success("Error: ${e.message}")
                    }
                }
            }
            // POST_NOTIFICATIONS without VpnService.prepare, for proxy mode.
            "requestNotificationPermission" -> {
                val currentActivity = activity
                if (currentActivity == null) {
                    result.error("NO_ACTIVITY", "Activity is not attached", null)
                    return
                }
                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
                    ActivityCompat.checkSelfPermission(
                        currentActivity,
                        Manifest.permission.POST_NOTIFICATIONS,
                    ) != PackageManager.PERMISSION_GRANTED
                ) {
                    ActivityCompat.requestPermissions(
                        currentActivity,
                        arrayOf(Manifest.permission.POST_NOTIFICATIONS),
                        REQUEST_CODE_POST_NOTIFICATIONS,
                    )
                }
                result.success(null)
            }
            "requestPermission" -> {
                val currentActivity = activity
                if (currentActivity == null) {
                    result.error("NO_ACTIVITY", "Activity is not attached", null)
                    return
                }
                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
                    if (ActivityCompat.checkSelfPermission(currentActivity, Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED) {
                        ActivityCompat.requestPermissions(currentActivity, arrayOf(Manifest.permission.POST_NOTIFICATIONS), REQUEST_CODE_POST_NOTIFICATIONS)
                    }
                }
                val request = VpnService.prepare(currentActivity)
                if (request != null) {
                    pendingResult = result
                    currentActivity.startActivityForResult(request, REQUEST_CODE_VPN_PERMISSION)
                } else {
                    result.success(true)
                }
            }
            else -> result.notImplemented()
        }
    }
    private fun registerReceiver() {
        if (activity == null) return
        if (xrayReceiver == null) {
            xrayReceiver = object : BroadcastReceiver() {
                override fun onReceive(context: Context?, intent: Intent?) {
                    if (intent == null || vpnStatusSink == null) return
                    val state = intent.getSerializableExtra("STATE") as? AppConfigs.V2RAY_STATES
                    val runtimeToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
                    val runtimeReady = intent.getBooleanExtra("RUNTIME_READY", false)
                    val duration = intent.getStringExtra("DURATION")
                    val uploadSpeed = intent.getLongExtra("UPLOAD_SPEED", 0)
                    val downloadSpeed = intent.getLongExtra("DOWNLOAD_SPEED", 0)
                    val uploadTraffic = intent.getLongExtra("UPLOAD_TRAFFIC", 0)
                    val downloadTraffic = intent.getLongExtra("DOWNLOAD_TRAFFIC", 0)
                    val currentToken = expectedRuntimeToken
                    if (currentToken == null) {
                        if (runtimeToken.isNotEmpty() &&
                            (state == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
                             state == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING)
                        ) {
                            expectedRuntimeToken = runtimeToken
                        } else {
                            return
                        }
                    } else if (runtimeToken != currentToken) {
                        return
                    }
                    val stateName = when (state) {
                        AppConfigs.V2RAY_STATES.V2RAY_CONNECTED -> if (runtimeReady) "CONNECTED" else "CONNECTING"
                        AppConfigs.V2RAY_STATES.V2RAY_CONNECTING -> "CONNECTING"
                        else -> "DISCONNECTED"
                    }
                    val data = ArrayList<String>()
                    data.add(duration ?: "0")
                    data.add(uploadSpeed.toString())
                    data.add(downloadSpeed.toString())
                    data.add(uploadTraffic.toString())
                    data.add(downloadTraffic.toString())
                    data.add(stateName)
                    if (state == AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED &&
                        runtimeToken.isNotEmpty() && runtimeToken == expectedRuntimeToken
                    ) {
                        expectedRuntimeToken = null
                        mainHandler.removeCallbacks(stopTimeoutRunnable)
                        pendingStopResult?.success(null)
                        pendingStopResult = null
                    }
                    vpnStatusSink?.success(data)
                }
            }
        }
        val filter = IntentFilter(AppConfigs.V2RAY_CONNECTION_INFO)
        val currentActivity = activity ?: return
        ContextCompat.registerReceiver(
            currentActivity,
            xrayReceiver,
            filter,
            ContextCompat.RECEIVER_NOT_EXPORTED,
        )
    }
    private fun unregisterReceiver() {
        val currentActivity = activity
        val receiver = xrayReceiver
        if (currentActivity != null && receiver != null) {
            try {
                currentActivity.unregisterReceiver(receiver)
            } catch (e: Exception) {
                Log.w(TAG, "Receiver was already detached during lifecycle cleanup", e)
            }
        }
        xrayReceiver = null
    }
    private fun failPendingPermission(code: String, message: String) {
        pendingResult?.error(code, message, null)
        pendingResult = null
    }
    override fun onDetachedFromEngine(binding: FlutterPlugin.FlutterPluginBinding) {
        mainHandler.removeCallbacks(stopTimeoutRunnable)
        pendingStopResult?.error("ENGINE_DETACHED", "Flutter engine detached during VPN shutdown", null)
        pendingStopResult = null
        failPendingPermission("ENGINE_DETACHED", "Flutter engine detached during VPN permission request")
        unregisterReceiver()
        vpnControlMethod.setMethodCallHandler(null)
        vpnStatusEvent.setStreamHandler(null)
        executor.shutdown()
    }
    override fun onAttachedToActivity(binding: ActivityPluginBinding) {
        activity = binding.activity
        binding.addActivityResultListener(this)
        if (vpnStatusSink != null) {
            registerReceiver()
        }
    }
    override fun onDetachedFromActivityForConfigChanges() {
        unregisterReceiver()
        activity = null
    }
    override fun onReattachedToActivityForConfigChanges(binding: ActivityPluginBinding) {
        activity = binding.activity
        binding.addActivityResultListener(this)
        if (vpnStatusSink != null) {
            registerReceiver()
        }
    }
    override fun onDetachedFromActivity() {
        failPendingPermission("NO_ACTIVITY", "Activity detached during VPN permission request")
        unregisterReceiver()
        activity = null
    }
    override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?): Boolean {
        if (requestCode == REQUEST_CODE_VPN_PERMISSION) {
            if (resultCode == Activity.RESULT_OK) {
                pendingResult?.success(true)
            } else {
                pendingResult?.success(false)
            }
            pendingResult = null
            return true
        }
        return false
    }
 }
@@ -0,0 +1,700 @@
 package com.github.tfox.flutter_vless.xray.core
 import android.app.Notification
 import android.app.NotificationChannel
 import android.app.NotificationManager
 import android.app.PendingIntent
 import android.app.Service
 import android.content.Context
 import android.content.Intent
 import android.content.pm.PackageManager
 import android.graphics.Color
 import android.os.Build
 import android.os.CountDownTimer
 import android.os.Handler
 import android.os.Looper
 import android.util.Log
 import androidx.core.app.ActivityCompat
 import androidx.core.app.NotificationCompat
 import com.github.tfox.flutter_vless.xray.dto.XrayConfig
 import com.github.tfox.flutter_vless.xray.service.XrayVPNService
 import com.github.tfox.flutter_vless.xray.utils.AppConfigs
 import com.github.tfox.flutter_vless.xray.utils.Utilities
 import org.json.JSONObject
 import org.json.JSONArray
 import java.io.File
 import java.io.FileOutputStream
 /**
 * Manages the Xray Core process (libxray.so).
 * 
 * This singleton object is responsible for:
 * 1. Generating the final Xray configuration file (config.json).
 * 2. Injecting necessary inbounds (SOCKS, HTTP, API) into the user-provided config.
 * 3. Starting and monitoring the Xray process.
 * 4. Collecting traffic statistics via the Xray API.
 * 5. Showing the persistent foreground notification.
 */
 object XrayCoreManager {
    private const val NOTIFICATION_ID = 1
    private const val TAG = "XrayCoreManager"
    // The core's output is kept only for its first seconds, and only to explain
    // a non-zero exit. A core that has been up longer than this may be carrying
    // traffic, and its log can name destinations, which must never reach the
    // device log (rule 95) - so past the window the buffer is dropped.
    private const val STARTUP_LOG_WINDOW_MS = 10_000L
    private const val STARTUP_LOG_MAX_LINES = 40
    private var xrayProcess: Process? = null
    private var countDownTimer: CountDownTimer? = null
    private var seconds = 0
    private fun deleteEphemeralConfigOnFailure(filesDir: File) {
        try {
            val config = File(filesDir, "config.json")
            if (config.exists() && !config.delete()) {
                Log.w(TAG, "Could not delete failed ephemeral Xray config")
            }
        } catch (e: Exception) {
            Log.w(TAG, "Could not delete failed ephemeral Xray config", e)
        }
    }
    private fun nextFreePort(preferredPort: Int, usedPorts: Set<Int>): Int {
        var port = preferredPort
        while (usedPorts.contains(port)) {
            port++
        }
        return port
    }
    private fun uniqueInboundTag(inbounds: JSONArray, preferredTag: String): String {
        val tags = mutableSetOf<String>()
        for (i in 0 until inbounds.length()) {
            val tag = inbounds.optJSONObject(i)?.optString("tag").orEmpty()
            if (tag.isNotEmpty()) tags.add(tag)
        }
        if (!tags.contains(preferredTag)) return preferredTag
        var index = 1
        var candidate = "${preferredTag}_$index"
        while (tags.contains(candidate)) {
            index++
            candidate = "${preferredTag}_$index"
        }
        return candidate
    }
    private fun normalizeRuntimeConfig(value: Any?): Any? {
        return when (value) {
            is JSONObject -> {
                val normalized = JSONObject()
                val aliases = mapOf(
                    "xHTTPSettings" to "xhttpSettings",
                    "httpUpgradeSettings" to "httpupgradeSettings",
                    "splitHTTPSettings" to "splithttpSettings"
                )
                val keys = value.keys()
                while (keys.hasNext()) {
                    val key = keys.next()
                    if (key == "allowInsecure") continue
                    val targetKey = aliases[key] ?: key
                    if (aliases.containsKey(key) && value.has(targetKey)) continue
                    val normalizedValue = normalizeRuntimeConfig(value.opt(key))
                    if (targetKey == "network" && normalizedValue is String) {
                        normalized.put(targetKey, normalizedValue.lowercase())
                    } else {
                        normalized.put(targetKey, normalizedValue)
                    }
                }
                normalized
            }
            is JSONArray -> {
                val normalized = JSONArray()
                for (i in 0 until value.length()) {
                    normalized.put(normalizeRuntimeConfig(value.opt(i)))
                }
                normalized
            }
            else -> value
        }
    }
    private fun normalizeVlessOutbounds(configJson: JSONObject) {
        val outbounds = configJson.optJSONArray("outbounds") ?: return
        for (i in 0 until outbounds.length()) {
            val outbound = outbounds.optJSONObject(i) ?: continue
            if (outbound.optString("protocol") != "vless") continue
            val settings = outbound.optJSONObject("settings") ?: continue
            if (settings.has("vnext")) continue
            val address = settings.optString("address")
            val id = settings.optString("id")
            val port = settings.optInt("port", 0)
            if (address.isEmpty() || id.isEmpty() || port <= 0) continue
            val user = JSONObject()
            user.put("id", id)
            user.put("encryption", settings.optString("encryption", "none"))
            user.put("flow", settings.optString("flow", ""))
            user.put("level", settings.optInt("level", 8))
            val server = JSONObject()
            server.put("address", address)
            server.put("port", port)
            server.put("users", JSONArray().put(user))
            val normalizedSettings = JSONObject()
            normalizedSettings.put("vnext", JSONArray().put(server))
            outbound.put("settings", normalizedSettings)
            Log.d(TAG, "Normalized flat VLESS outbound settings for $address:$port")
        }
    }
    private fun sanitizeLogPaths(configJson: JSONObject, filesDir: File) {
        val log = configJson.optJSONObject("log") ?: return
        // The VPN client never needs destination/access logs. A server-provided
        // config must not silently enable browsing metadata collection locally.
        log.remove("access")
        try { File(filesDir, "access.log").delete() } catch (_: Exception) {}
        val errorPath = log.optString("error")
        if (errorPath.isNotEmpty()) {
            log.put("error", File(filesDir, "error.log").absolutePath)
        }
    }
    internal fun buildRuntimeConfigJson(config: XrayConfig, filesDir: File): JSONObject {
        val configJson = normalizeRuntimeConfig(
            JSONObject(config.V2RAY_FULL_JSON_CONFIG)
        ) as JSONObject
        normalizeVlessOutbounds(configJson)
        sanitizeLogPaths(configJson, filesDir)
        // ReVolt needs only its authenticated local SOCKS ingress.
        val inbounds = configJson.optJSONArray("inbounds") ?: JSONArray()
        var secureSocksEnabled = false
        for (i in 0 until inbounds.length()) {
            val inbound = inbounds.optJSONObject(i) ?: continue
            if (inbound.optString("tag") != "revolt-secure-socks") continue
            val settings = inbound.optJSONObject("settings")
                ?: throw IllegalStateException("Secure SOCKS5 settings are missing")
            val users = settings.optJSONArray("users")
                ?: throw IllegalStateException("Secure SOCKS5 users are missing")
            val account = users.optJSONObject(0)
                ?: throw IllegalStateException("Secure SOCKS5 account is missing")
            val port = inbound.optInt("port", -1)
            if (inbound.optString("protocol") != "socks" ||
                inbound.optString("listen") != "127.0.0.1" ||
                port <= 1024 || port > 65535 ||
                settings.optString("auth") != "password" ||
                account.optString("user").isEmpty() ||
                account.optString("pass").isEmpty()
            ) {
                throw IllegalStateException("Secure SOCKS5 session is invalid")
            }
            config.LOCAL_SOCKS5_PORT = port
            config.LOCAL_HTTP_PORT = 0
            secureSocksEnabled = true
            break
        }
        val usedPorts = mutableSetOf<Int>()
        var hasSocksOnLocalPort = false
        var hasHttpOnLocalPort = false
        for (i in 0 until inbounds.length()) {
            val inbound = inbounds.getJSONObject(i)
            val protocol = inbound.optString("protocol")
            val port = inbound.optInt("port", -1)
            if (port > 0) usedPorts.add(port)
            if (protocol == "socks" && port == config.LOCAL_SOCKS5_PORT) hasSocksOnLocalPort = true
            if (protocol == "http" && port == config.LOCAL_HTTP_PORT) hasHttpOnLocalPort = true
        }
        if (!hasSocksOnLocalPort) {
            if (usedPorts.contains(config.LOCAL_SOCKS5_PORT)) {
                config.LOCAL_SOCKS5_PORT = nextFreePort(config.LOCAL_SOCKS5_PORT, usedPorts)
            }
            val socksInbound = JSONObject()
            socksInbound.put("tag", uniqueInboundTag(inbounds, "socks"))
            socksInbound.put("port", config.LOCAL_SOCKS5_PORT)
            socksInbound.put("listen", "127.0.0.1")
            socksInbound.put("protocol", "socks")
            socksInbound.put("settings", JSONObject().put("auth", "noauth").put("udp", true))
            socksInbound.put(
                "sniffing",
                JSONObject().put("enabled", true).put("destOverride", JSONArray().put("http").put("tls"))
            )
            inbounds.put(socksInbound)
            usedPorts.add(config.LOCAL_SOCKS5_PORT)
            Log.d(TAG, "Injected SOCKS inbound on port ${config.LOCAL_SOCKS5_PORT}")
        }
        if (!secureSocksEnabled && !hasHttpOnLocalPort) {
            if (usedPorts.contains(config.LOCAL_HTTP_PORT)) {
                config.LOCAL_HTTP_PORT = nextFreePort(config.LOCAL_HTTP_PORT, usedPorts)
            }
            val httpInbound = JSONObject()
            httpInbound.put("tag", uniqueInboundTag(inbounds, "http"))
            httpInbound.put("port", config.LOCAL_HTTP_PORT)
            httpInbound.put("listen", "127.0.0.1")
            httpInbound.put("protocol", "http")
            inbounds.put(httpInbound)
            usedPorts.add(config.LOCAL_HTTP_PORT)
            Log.d(TAG, "Injected HTTP inbound on port ${config.LOCAL_HTTP_PORT}")
        }
        return configJson
    }
    internal fun buildDelayConfigJson(configJson: String, proxyPort: Int, filesDir: File): Pair<JSONObject, Int> {
        val delayConfig = XrayConfig(
            V2RAY_FULL_JSON_CONFIG = configJson,
            LOCAL_SOCKS5_PORT = proxyPort,
            LOCAL_HTTP_PORT = proxyPort + 1,
            LOCAL_API_PORT = proxyPort + 2
        )
        val runtimeJson = buildRuntimeConfigJson(delayConfig, filesDir)
        return Pair(runtimeJson, delayConfig.LOCAL_SOCKS5_PORT)
    }
    /**
     * Starts the Xray Core process.
     * 
     * @param context The service context (needed for file access and notifications).
     * @param config The configuration object containing the user's settings.
     * @return true if started successfully, false otherwise.
     */
    fun startCore(context: Service, config: XrayConfig): Boolean {
        AppConfigs.RUNTIME_READY = false
        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
        AppConfigs.V2RAY_CONFIG = config
        // 1. Prepare the configuration file
        val configFilesDir = context.filesDir
        try {
            val configJson = buildRuntimeConfigJson(config, configFilesDir)
            val configFile = File(context.filesDir, "config.json")
            configFile.writeText(configJson.toString())
        } catch (e: Exception) {
            Log.e(TAG, "Failed to write config file", e)
            deleteEphemeralConfigOnFailure(configFilesDir)
            return false
        }
        // 2. Find Xray executable (libxray.so)
        val nativeLibraryDir = context.applicationInfo.nativeLibraryDir
        val xrayExecutable = File(nativeLibraryDir, "libxray.so")
        if (!xrayExecutable.exists()) {
            Log.e(TAG, "Xray executable not found at ${xrayExecutable.absolutePath}")
            deleteEphemeralConfigOnFailure(configFilesDir)
            return false
        }
        // 3. Prepare assets (geoip, geosite)
        try {
            Utilities.copyAssets(context)
        } catch (e: Exception) {
            Log.e(TAG, "Failed to prepare Xray assets", e)
            deleteEphemeralConfigOnFailure(configFilesDir)
            return false
        }
        // 4. Run Xray
        try {
            val cmd = listOf(
                xrayExecutable.absolutePath,
                "-config", File(configFilesDir, "config.json").absolutePath
            )
            val pb = ProcessBuilder(cmd)
            pb.directory(configFilesDir)
            pb.redirectErrorStream(true)
            // Set environment variables (XRAY_LOCATION_ASSET is crucial for finding geoip/geosite)
            val env = pb.environment()
            env["XRAY_LOCATION_ASSET"] = Utilities.getUserAssetsPath(context)
            xrayProcess = pb.start()
            Thread.sleep(300)
            if (xrayProcess?.isAlive != true) {
                val output = xrayProcess?.inputStream?.bufferedReader()?.readText().orEmpty()
                Log.e(TAG, "Xray process exited during startup. Output: $output")
                xrayProcess = null
                AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED
                deleteEphemeralConfigOnFailure(configFilesDir)
                return false
            }
            // config.json contains per-session SOCKS credentials. Xray has
            // consumed it after the startup liveness check, so remove it now.
            try {
                val ephemeralConfig = File(configFilesDir, "config.json")
                if (ephemeralConfig.exists() && !ephemeralConfig.delete()) {
                    Log.w(TAG, "Could not delete ephemeral Xray config")
                }
            } catch (e: Exception) {
                Log.w(TAG, "Could not delete ephemeral Xray config", e)
            }
            AppConfigs.RUNTIME_READY = false
            AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
            startTimer(context)
            showNotification(context, config)
            sendStatusBroadcast(context, config)
            val process = xrayProcess ?: return false
            // Monitor process in a separate thread to detect crash
            Thread {
                try {
                    val startedAt = System.currentTimeMillis()
                    val startupLog = ArrayDeque<String>()
                    process.inputStream.bufferedReader().use { reader ->
                        reader.forEachLine { line ->
                            if (System.currentTimeMillis() - startedAt <= STARTUP_LOG_WINDOW_MS) {
                                if (startupLog.size >= STARTUP_LOG_MAX_LINES) startupLog.removeFirst()
                                startupLog.addLast(line)
                            } else if (startupLog.isNotEmpty()) {
                                startupLog.clear()
                            }
                        }
                    }
                    val exitCode = process.waitFor()
                    if (exitCode != 0 && startupLog.isNotEmpty()) {
                        Log.e(
                            TAG,
                            "Xray process exited with code $exitCode; startup output:\n" +
                                startupLog.joinToString("\n")
                        )
                    } else {
                        Log.e(TAG, "Xray process exited with code $exitCode")
                    }
                    if (xrayProcess === process &&
                        AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN == config.RUNTIME_TOKEN &&
                        (AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
                         AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING)
                    ) {
                        // Hold the Android TUN while the core is recovered. Killing
                        // the VPN service here would allow direct-network fallback.
                        xrayProcess = null
                        AppConfigs.RUNTIME_READY = false
                        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
                        sendStatusBroadcast(context, config)
                        if (context is XrayVPNService) {
                            context.handleXrayCoreExit(config)
                        } else {
                            stopCore(context)
                        }
                    }
                } catch (e: java.io.InterruptedIOException) {
                    // Expected when stopping
                } catch (e: InterruptedException) {
                    // Expected when stopping
                } catch (e: Exception) {
                    Log.e(TAG, "Error reading xray output", e)
                }
            }.start()
            return true
        } catch (e: Exception) {
            Log.e(TAG, "Failed to start Xray process", e)
            // The process may already be running: pb.start() succeeds before
            // anything below it can throw. Leaving it alive leaked one live
            // core per recovery attempt. Clear the field BEFORE destroying so
            // the monitor thread's `xrayProcess === process` guard fails and
            // recovery is not re-entered for a core we are killing here.
            val orphan = xrayProcess
            xrayProcess = null
            try {
                orphan?.destroy()
            } catch (destroyError: Exception) {
                Log.w(TAG, "Failed to destroy partially started Xray process", destroyError)
            }
            deleteEphemeralConfigOnFailure(configFilesDir)
            return false
        }
    }
    /**
     * Stops the Xray Core process and cleans up notifications.
     */
    fun stopCore(context: Service, confirmationToken: String? = AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN) {
        try {
            xrayProcess?.destroy()
            xrayProcess = null
        } catch (e: Exception) {
            Log.e(TAG, "Failed to destroy Xray process", e)
        }
        AppConfigs.RUNTIME_READY = false
        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED
        stopTimer()
        val notificationManager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
        notificationManager.cancel(NOTIFICATION_ID)
        sendDisconnectedBroadcast(context, confirmationToken.orEmpty())
        AppConfigs.V2RAY_CONFIG = null
    }
    fun markRuntimeConnecting(context: Context, config: XrayConfig) {
        if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != config.RUNTIME_TOKEN) return
        AppConfigs.RUNTIME_READY = false
        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
        sendStatusBroadcast(context, config)
    }
    fun markRuntimeReady(context: Service, config: XrayConfig) {
        if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != config.RUNTIME_TOKEN) return
        AppConfigs.RUNTIME_READY = true
        AppConfigs.V2RAY_STATE = AppConfigs.V2RAY_STATES.V2RAY_CONNECTED
        showNotification(context, config)
        sendStatusBroadcast(context, config)
    }
    fun isXrayRunning(): Boolean {
        // Check state instead of process because VPN runs in separate service process
        return AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTED ||
               AppConfigs.V2RAY_STATE == AppConfigs.V2RAY_STATES.V2RAY_CONNECTING
    }
    // CountDownTimer builds a Handler, so it only constructs on a looper thread.
    // Core recovery runs on a bare Thread (XrayVPNService.handleXrayCoreExit),
    // where this threw "Can't create handler inside thread ... that has not
    // called Looper.prepare()" and took the whole restart down with it.
    private val mainHandler = Handler(Looper.getMainLooper())
    private fun runOnMain(block: () -> Unit) {
        if (Looper.myLooper() == Looper.getMainLooper()) block() else mainHandler.post(block)
    }
    private fun startTimer(context: Context) {
        // Captured now: a stop that lands while the post is queued must not
        // leave a timer ticking for a generation that is already gone.
        val token = AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN
        runOnMain { startTimerOnMain(context, token) }
    }
    private fun startTimerOnMain(context: Context, token: String?) {
        if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != token) return
        countDownTimer?.cancel()
        seconds = 0
        countDownTimer = object : CountDownTimer(Long.MAX_VALUE, 1000) {
            override fun onTick(millisUntilFinished: Long) {
                seconds++
                val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
                intent.putExtra("STATE", AppConfigs.V2RAY_STATE)
                intent.putExtra("RUNTIME_TOKEN", AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN.orEmpty())
                intent.putExtra("RUNTIME_READY", AppConfigs.RUNTIME_READY)
                intent.putExtra("DURATION", seconds.toString())
                intent.putExtra("UPLOAD_SPEED", 0L)
                intent.putExtra("DOWNLOAD_SPEED", 0L)
                intent.putExtra("UPLOAD_TRAFFIC", 0L)
                intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
                context.sendBroadcast(intent)
            }
            override fun onFinish() {}
        }.start()
    }
    private fun stopTimer() {
        runOnMain {
            countDownTimer?.cancel()
            countDownTimer = null
            seconds = 0
        }
    }
    fun sendStatusBroadcast(context: Context, config: XrayConfig) {
        val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
        intent.putExtra("STATE", AppConfigs.V2RAY_STATE)
        intent.putExtra("RUNTIME_TOKEN", config.RUNTIME_TOKEN)
        intent.putExtra("RUNTIME_READY", AppConfigs.RUNTIME_READY)
        intent.putExtra("DURATION", seconds.toString())
        intent.putExtra("UPLOAD_SPEED", 0L)
        intent.putExtra("DOWNLOAD_SPEED", 0L)
        intent.putExtra("UPLOAD_TRAFFIC", 0L)
        intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
        context.sendBroadcast(intent)
    }
    private fun sendDisconnectedBroadcast(context: Context, runtimeToken: String) {
        val intent = Intent(AppConfigs.V2RAY_CONNECTION_INFO).setPackage(context.packageName)
        intent.putExtra("STATE", AppConfigs.V2RAY_STATES.V2RAY_DISCONNECTED)
        intent.putExtra("RUNTIME_TOKEN", runtimeToken)
        intent.putExtra("RUNTIME_READY", false)
        intent.putExtra("DURATION", "0")
        intent.putExtra("UPLOAD_SPEED", 0L)
        intent.putExtra("DOWNLOAD_SPEED", 0L)
        intent.putExtra("UPLOAD_TRAFFIC", 0L)
        intent.putExtra("DOWNLOAD_TRAFFIC", 0L)
        context.sendBroadcast(intent)
    }
    private fun showNotification(context: Service, config: XrayConfig) {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
            if (ActivityCompat.checkSelfPermission(context, android.Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED) {
                return
            }
        }
        val channelId = createNotificationChannel(context, config.APPLICATION_NAME)
        val launchIntent = context.packageManager.getLaunchIntentForPackage(context.packageName)
        launchIntent?.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or Intent.FLAG_ACTIVITY_CLEAR_TOP or Intent.FLAG_ACTIVITY_NEW_TASK
        val flags = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT else PendingIntent.FLAG_UPDATE_CURRENT
        val contentPendingIntent = PendingIntent.getActivity(context, 0, launchIntent, flags)
        val stopIntent = Intent(context, XrayVPNService::class.java)
        stopIntent.putExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE)
        stopIntent.putExtra("RUNTIME_TOKEN", config.RUNTIME_TOKEN)
        val stopPendingIntent = PendingIntent.getService(context, 0, stopIntent, flags)
        val smallIcon = if (config.APPLICATION_ICON != 0) config.APPLICATION_ICON else android.R.drawable.ic_dialog_info
        val builder = NotificationCompat.Builder(context, channelId)
            .setSmallIcon(smallIcon)
            .setContentTitle(config.REMARK)
            .setContentText(if (AppConfigs.RUNTIME_READY) "Connected" else "Connecting")
            .addAction(0, config.NOTIFICATION_DISCONNECT_BUTTON_NAME, stopPendingIntent)
            .setContentIntent(contentPendingIntent)
            .setPriority(NotificationCompat.PRIORITY_MIN)
            .setOngoing(true)
            .setShowWhen(true)
        context.startForeground(NOTIFICATION_ID, builder.build())
    }
    fun getConnectedV2rayServerDelay(context: Context, url: String): Long {
        // Use the configured SOCKS port (default 10807)
        val port = AppConfigs.V2RAY_CONFIG?.LOCAL_SOCKS5_PORT ?: 10807
        Log.d(TAG, "getConnectedV2rayServerDelay: Testing delay to $url via SOCKS port $port")
        return try {
            val start = System.currentTimeMillis()
            val proxy = java.net.Proxy(java.net.Proxy.Type.SOCKS, java.net.InetSocketAddress("127.0.0.1", port))
            val connection = java.net.URL(url).openConnection(proxy) as java.net.HttpURLConnection
            connection.connectTimeout = 5000
            connection.readTimeout = 5000
            connection.requestMethod = "HEAD"
            val responseCode = connection.responseCode
            val end = System.currentTimeMillis()
            val delay = end - start
            connection.disconnect()
            Log.d(TAG, "getConnectedV2rayServerDelay: Success! Response code: $responseCode, Delay: ${delay}ms")
            delay
        } catch (e: Exception) {
            Log.e(TAG, "getConnectedV2rayServerDelay: Failed to measure delay (VPN may not be running)", e)
            -1L
        }
    }
    /**
     * Measure delay for a server configuration (when not connected).
     * Temporarily starts Xray with the provided config, measures delay, then stops it.
     */
    fun getServerDelay(context: Context, configJson: String, url: String): Long {
        Log.d(TAG, "getServerDelay: Starting temporary Xray instance")
        var tempProcess: Process? = null
        try {
            // Find a random free port to avoid conflict with running VPN
            val freePort = try {
                val socket = java.net.ServerSocket(0)
                val port = socket.localPort
                socket.close()
                port
            } catch (e: Exception) {
                10806 // Fallback
            }
            val (json, socksPort) = buildDelayConfigJson(configJson, freePort, context.filesDir)
            Log.d(TAG, "getServerDelay: Using SOCKS port $socksPort")
            // Write temp config file
            val tempConfigFile = File(context.filesDir, "temp_delay_config.json")
            tempConfigFile.writeText(json.toString())
            // Copy assets
            Utilities.copyAssets(context)
            // Start Xray process
            val xrayExecutable = File(context.applicationInfo.nativeLibraryDir, "libxray.so")
            if (!xrayExecutable.exists()) {
                Log.e(TAG, "getServerDelay: Xray executable not found")
                return -1L
            }
            val cmd = listOf(
                xrayExecutable.absolutePath,
                "-config", tempConfigFile.absolutePath
            )
            val pb = ProcessBuilder(cmd)
            pb.directory(context.filesDir)
            val env = pb.environment()
            env["XRAY_LOCATION_ASSET"] = Utilities.getUserAssetsPath(context)
            tempProcess = pb.start()
            // Wait a bit for Xray to start
            Thread.sleep(1000)
            // Measure delay
            val delay = try {
                val start = System.currentTimeMillis()
                val proxy = java.net.Proxy(java.net.Proxy.Type.SOCKS, java.net.InetSocketAddress("127.0.0.1", socksPort))
                val connection = java.net.URL(url).openConnection(proxy) as java.net.HttpURLConnection
                connection.connectTimeout = 5000
                connection.readTimeout = 5000
                connection.requestMethod = "HEAD"
                val responseCode = connection.responseCode
                val end = System.currentTimeMillis()
                connection.disconnect()
                val result = end - start
                Log.d(TAG, "getServerDelay: Success! Response code: $responseCode, Delay: ${result}ms")
                result
            } catch (e: Exception) {
                Log.e(TAG, "getServerDelay: Failed to measure delay", e)
                -1L
            }
            // Stop temp process
            tempProcess?.destroy()
            tempConfigFile.delete()
            return delay
        } catch (e: Exception) {
            Log.e(TAG, "getServerDelay: Error starting temp Xray", e)
            tempProcess?.destroy()
            return -1L
        }
    }
    private fun createNotificationChannel(context: Context, appName: String): String {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
            val channelId = "REVOLT_VPN_SERVICE"
            val channelName = "$appName Background Service"
            val channel = NotificationChannel(channelId, channelName, NotificationManager.IMPORTANCE_LOW)
            channel.lightColor = Color.BLUE
            channel.lockscreenVisibility = Notification.VISIBILITY_PRIVATE
            val manager = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
            manager.createNotificationChannel(channel)
            return channelId
        }
        return ""
    }
 }
@@ -0,0 +1,71 @@
 package com.github.tfox.flutter_vless.xray.dto
 import java.io.Serializable
 import java.util.ArrayList
 /**
 * Data class representing the Xray configuration and app settings.
 * 
 * This class is passed from Flutter to Android and contains:
 * 1. The full Xray JSON configuration (V2RAY_FULL_JSON_CONFIG).
 * 2. App-specific settings like blocked apps, notification text, etc.
 * 3. Connection parameters (server address, ports).
 */
 data class XrayConfig(
    /** The IP address of the connected server (used to exclude it from VPN routing). */
    var CONNECTED_V2RAY_SERVER_ADDRESS: String = "",
    /** The port of the connected server. */
    var CONNECTED_V2RAY_SERVER_PORT: String = "",
    /** Local port for SOCKS5 proxy (default: 10807). used by tun2socks. */
    var LOCAL_SOCKS5_PORT: Int = 10807,
    /** Local port for HTTP proxy (default: 10808). */
    var LOCAL_HTTP_PORT: Int = 10808,
    /** Local port for Xray API (stats, etc.) (default: 10809). */
    var LOCAL_API_PORT: Int = 10809,
    /** Timeout for connections in milliseconds. */
    var ALLOWED_TIMEOUT_MS: Int = 0,
    /** List of subnets to bypass (not routed through VPN). */
    var BYPASS_SUBNETS: ArrayList<String> = ArrayList(),
    /** List of app package names to exclude from VPN. */
    var BLOCKED_APPS: ArrayList<String> = ArrayList(),
    /** The raw Xray configuration JSON string. */
    var V2RAY_FULL_JSON_CONFIG: String = "",
    /** Whether to enable traffic statistics collection. */
    var ENABLE_TRAFFIC_STATICS: Boolean = false,
    /** Remark/Name of the server configuration. */
    var REMARK: String = "",
    /** Name of the application (displayed in notification). */
    var APPLICATION_NAME: String = "Flutter Vless",
    /** Resource ID of the notification icon. */
    var APPLICATION_ICON: Int = 0,
    /** Resource name of the notification icon (e.g. "ic_notification"). */
    var NOTIFICATION_ICON_RESOURCE_NAME: String = "",
    /** Resource type of the notification icon (e.g. "drawable"). */
    var NOTIFICATION_ICON_RESOURCE_TYPE: String = "",
    /** Text for the disconnect button in the notification. */
    var NOTIFICATION_DISCONNECT_BUTTON_NAME: String = "Disconnect",
    /** Domain resolution strategy (e.g. "IPIfNonMatch"). */
    var DOMAIN_STRATEGY: String = "",
    /** Routing domain strategy. */
    var ROUTING_DOMAIN_STRATEGY: String = "",
    /** Unique generation token used to reject stale native runtime events. */
    var RUNTIME_TOKEN: String = ""
 ) : Serializable
@@ -0,0 +1,827 @@
 package com.github.tfox.flutter_vless.xray.service
 import android.app.AlarmManager
 import android.app.PendingIntent
 import android.content.Context
 import android.content.Intent
 import android.net.LocalSocket
 import android.net.LocalSocketAddress
 import android.net.VpnService
 import android.os.Build
 import android.os.Handler
 import android.os.Looper
 import android.os.ParcelFileDescriptor
 import android.os.SystemClock
 import android.util.Log
 import com.github.tfox.flutter_vless.xray.core.XrayCoreManager
 import com.github.tfox.flutter_vless.xray.dto.XrayConfig
 import com.github.tfox.flutter_vless.xray.utils.AppConfigs
 import com.github.tfox.flutter_vless.xray.utils.RevoltAlerts
 import org.json.JSONObject
 import java.io.File
 /**
 * Android VPN Service implementation.
 *
 * This service owns the TUN interface and keeps runtime state generation-scoped.
 * Session deadlines are enforced both by an in-process monotonic timer and by
 * AlarmManager, while only the non-secret token/deadline pair is persisted.
 * Per-session VLESS/SOCKS credentials remain memory-only.
 */
 class XrayVPNService : VpnService() {
    private var mInterface: ParcelFileDescriptor? = null
    private var tun2socksProcess: Process? = null
    @Volatile private var isRunning = false
    @Volatile private var recoveringXray = false
    @Volatile private var recoveringTun2socks = false
    private var tun2socksRecoveryAttempt = 0
    private var currentConfig: XrayConfig? = null
    private var currentProxyOnly = false
    private var shuttingDownIntentionally = false
    private val deadlineHandler = Handler(Looper.getMainLooper())
    private var sessionDeadlineElapsed: Long? = null
    private var sessionDeadlineToken: String? = null
    private val sessionDeadlineRunnable = Runnable { enforceSessionDeadline() }
    // The warning's own backstop, mirroring the deadline's. The alarm alone is
    // not enough: it is inexact on purpose (no SCHEDULE_EXACT_ALARM), and with
    // the app closed on a dozing device it was measured never arriving at all,
    // while the deadline's Handler fired within a second of its target.
    private val sessionWarningRunnable = Runnable {
        handleSessionWarningAlarm(sessionDeadlineToken.orEmpty())
    }
    override fun onCreate() {
        super.onCreate()
    }
    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
        if (intent == null) {
            if (isRunning && currentConfig != null) return START_REDELIVER_INTENT
            // Session credentials intentionally stay memory-only. If Android
            // cannot redeliver the original START intent, fail closed instead
            // of rebuilding a tunnel from sensitive material stored on disk.
            clearPersistedDeadline()
            cancelSessionExpiryAlarm()
            stopSelf()
            return START_NOT_STICKY
        }
        if (intent.getBooleanExtra(EXTRA_SESSION_EXPIRED, false)) {
            enforcePersistedDeadline(intent.getStringExtra("RUNTIME_TOKEN").orEmpty())
            return START_NOT_STICKY
        }
        // Must stay above the command dispatch: an intent with no COMMAND
        // falls through to the final else and stops the tunnel.
        if (intent.getBooleanExtra(EXTRA_SESSION_WARNING, false)) {
            handleSessionWarningAlarm(intent.getStringExtra("RUNTIME_TOKEN").orEmpty())
            return START_NOT_STICKY
        }
        val command = if (Build.VERSION.SDK_INT >= 33) {
            intent.getSerializableExtra("COMMAND", AppConfigs.V2RAY_SERVICE_COMMANDS::class.java)
        } else {
            @Suppress("DEPRECATION")
            intent.getSerializableExtra("COMMAND") as? AppConfigs.V2RAY_SERVICE_COMMANDS
        }
        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.STOP_SERVICE) {
            val requestedToken = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
            val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
            if (requestedToken.isEmpty() ||
                (activeToken.isNotEmpty() && requestedToken != activeToken)
            ) {
                Log.w(TAG, "Ignoring STOP_SERVICE without matching runtime generation")
                return START_NOT_STICKY
            }
            stopAll(requestedToken, userRequested = true)
            return START_NOT_STICKY
        }
        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.UPDATE_SESSION_DEADLINE) {
            updateSessionDeadline(intent)
            return if (isRunning) START_REDELIVER_INTENT else START_NOT_STICKY
        }
        createNotificationChannel()
        val notification = createNotification("VPN Service Running")
        try {
            if (Build.VERSION.SDK_INT >= 34) {
                startForeground(1, notification, FOREGROUND_SERVICE_TYPE_SPECIAL_USE)
            } else {
                startForeground(1, notification)
            }
        } catch (e: Exception) {
            Log.e(TAG, "Failed to start foreground", e)
            clearPersistedDeadline()
            cancelSessionExpiryAlarm()
            stopSelf()
            return START_NOT_STICKY
        }
        if (command == AppConfigs.V2RAY_SERVICE_COMMANDS.START_SERVICE) {
            val config = if (Build.VERSION.SDK_INT >= 33) {
                intent.getSerializableExtra("V2RAY_CONFIG", XrayConfig::class.java)
            } else {
                @Suppress("DEPRECATION")
                intent.getSerializableExtra("V2RAY_CONFIG") as? XrayConfig
            }
            if (config != null) {
                if (XrayCoreManager.isXrayRunning()) {
                    Log.w(TAG, "Stopping stale Xray core before restart")
                    XrayCoreManager.stopCore(this)
                }
                cleanup(clearDeadline = true)
                RevoltAlerts.cancelAll(this)
                shuttingDownIntentionally = false
                currentConfig = config
                val proxyOnly = intent.getBooleanExtra("PROXY_ONLY", false)
                currentProxyOnly = proxyOnly
                armSessionDeadline(config, BOOTSTRAP_SESSION_SECONDS)
                if (shuttingDownIntentionally) return START_NOT_STICKY
                if (XrayCoreManager.startCore(this, config)) {
                    if (!proxyOnly) {
                        setupVpn(config)
                    } else {
                        isRunning = true
                        Log.d(TAG, "Starting in PROXY_ONLY mode")
                        XrayCoreManager.markRuntimeReady(this, config)
                    }
                } else {
                    stopAll(config.RUNTIME_TOKEN)
                    return START_NOT_STICKY
                }
            } else {
                Log.e(TAG, "START_SERVICE missing V2RAY_CONFIG")
                stopAll()
                return START_NOT_STICKY
            }
        } else {
            stopAll()
            return START_NOT_STICKY
        }
        return START_REDELIVER_INTENT
    }
    private fun setupVpn(config: XrayConfig) {
        try {
            if (mInterface != null) {
                mInterface?.close()
                mInterface = null
            }
            val builder = Builder()
            builder.setSession(config.REMARK)
            builder.setMtu(1500)
            builder.addAddress("26.26.26.1", 30)
            builder.addAddress("fd00:26:26::1", 126)
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
                builder.setMetered(false)
            }
            if (config.BLOCKED_APPS.isNotEmpty()) {
                throw IllegalStateException("Per-app VPN bypass is disabled in ReVolt")
            }
            try {
                builder.addDisallowedApplication(packageName)
            } catch (e: Exception) {
                throw IllegalStateException("Failed to exclude ReVolt from its own VPN", e)
            }
            builder.addRoute("0.0.0.0", 0)
            builder.addRoute("::", 0)
            try {
                builder.addDnsServer("8.8.8.8")
                builder.addDnsServer("1.1.1.1")
            } catch (e: Exception) {
                throw IllegalStateException("Failed to configure VPN DNS", e)
            }
            mInterface = builder.establish()
                ?: throw IllegalStateException("Android refused to establish VPN interface")
            isRunning = true
            runTun2socks(config)
        } catch (e: Exception) {
            Log.e(TAG, "Failed to setup VPN", e)
            stopAll()
        }
    }
    private data class SecureSocksCredentials(
        val port: Int,
        val username: String,
        val password: String,
    )
    private fun secureSocksCredentials(config: XrayConfig): SecureSocksCredentials? {
        val inbounds = try {
            JSONObject(config.V2RAY_FULL_JSON_CONFIG).optJSONArray("inbounds")
        } catch (_: Exception) {
            null
        } ?: return null
        for (i in 0 until inbounds.length()) {
            val inbound = inbounds.optJSONObject(i) ?: continue
            if (inbound.optString("tag") != "revolt-secure-socks") continue
            if (inbound.optString("protocol") != "socks" ||
                inbound.optString("listen") != "127.0.0.1"
            ) return null
            val settings = inbound.optJSONObject("settings") ?: return null
            if (settings.optString("auth") != "password") return null
            val user = settings.optJSONArray("users")?.optJSONObject(0) ?: return null
            val port = inbound.optInt("port", -1)
            val username = user.optString("user")
            val password = user.optString("pass")
            if (port <= 1024 || port > 65535 || username.isEmpty() || password.isEmpty()) {
                return null
            }
            return SecureSocksCredentials(port, username, password)
        }
        return null
    }
    private fun scheduleTun2socksRecovery(config: XrayConfig, reason: String) {
        if (!isRunning || currentConfig !== config || recoveringTun2socks) return
        XrayCoreManager.markRuntimeConnecting(this, config)
        recoveringTun2socks = true
        val attempt = ++tun2socksRecoveryAttempt
        val shift = (attempt - 1).coerceIn(0, 6)
        val delayMs = (500L * (1L shl shift)).coerceAtMost(30_000L)
        Log.w(TAG, "Scheduling tun2socks recovery attempt $attempt in ${delayMs}ms: $reason")
        Thread {
            try {
                Thread.sleep(delayMs)
            } catch (_: InterruptedException) {
                recoveringTun2socks = false
                return@Thread
            }
            recoveringTun2socks = false
            if (isRunning && currentConfig === config) {
                runTun2socks(config)
            }
        }.start()
    }
    private fun runTun2socks(config: XrayConfig) {
        val tun2socksPath = File(applicationInfo.nativeLibraryDir, "libtun2socks.so").absolutePath
        val socketFile = File(filesDir, "sock_path")
        if (socketFile.exists() && !socketFile.delete()) {
            Log.w(TAG, "Could not delete stale tun2socks socket")
        }
        val sockPath = socketFile.absolutePath
        val secure = secureSocksCredentials(config)
            ?: throw IllegalStateException("Authenticated ReVolt SOCKS5 inbound missing")
        config.LOCAL_SOCKS5_PORT = secure.port
        val cmd = arrayListOf(
            tun2socksPath,
            "-sock-path", sockPath,
            "-proxy", "socks5://${secure.username}:${secure.password}@127.0.0.1:${secure.port}",
            "-mtu", "1500",
            "-loglevel", "debug"
        )
        Log.d(TAG, "Starting tun2socks with authenticated loopback SOCKS5")
        try {
            val pb = ProcessBuilder(cmd)
            pb.redirectErrorStream(true)
            pb.directory(filesDir)
            val process = pb.start()
            tun2socksProcess = process
            Thread {
                try {
                    process.inputStream.bufferedReader().use { reader ->
                        reader.forEachLine { _ -> }
                    }
                    process.waitFor()
                    if (isRunning && tun2socksProcess === process && currentConfig === config) {
                        Log.e(TAG, "tun2socks exited unexpectedly; keeping TUN fail-closed")
                        tun2socksProcess = null
                        scheduleTun2socksRecovery(config, "process exited")
                    }
                } catch (_: java.io.InterruptedIOException) {
                    // Expected when stopping
                } catch (_: InterruptedException) {
                    // Expected when stopping
                } catch (e: Exception) {
                    Log.e(TAG, "Error reading tun2socks output", e)
                }
            }.start()
            sendFd(process, config)
        } catch (e: Exception) {
            Log.e(TAG, "Failed to start tun2socks; keeping TUN fail-closed", e)
            scheduleTun2socksRecovery(config, "start failure")
        }
    }
    private fun sendFd(process: Process, config: XrayConfig) {
        val fd = mInterface?.fileDescriptor ?: return
        val sockFile = File(filesDir, "sock_path").absolutePath
        Thread {
            var tries = 0
            while (tries < 10 && isRunning && tun2socksProcess === process && process.isAlive) {
                var localSocket: LocalSocket? = null
                try {
                    Thread.sleep(500)
                    localSocket = LocalSocket()
                    localSocket.connect(LocalSocketAddress(sockFile, LocalSocketAddress.Namespace.FILESYSTEM))
                    val out = localSocket.outputStream
                    localSocket.setFileDescriptorsForSend(arrayOf(fd))
                    out.write(32)
                    out.flush()
                    localSocket.setFileDescriptorsForSend(null)
                    localSocket.shutdownOutput()
                    localSocket.close()
                    if (isRunning && currentConfig === config && tun2socksProcess === process) {
                        tun2socksRecoveryAttempt = 0
                        XrayCoreManager.markRuntimeReady(this, config)
                    }
                    return@Thread
                } catch (_: Exception) {
                    tries++
                    try {
                        localSocket?.close()
                    } catch (closeError: Exception) {
                        Log.w(TAG, "Failed to close tun2socks handoff socket", closeError)
                    }
                }
            }
            if (isRunning && tun2socksProcess === process) {
                Log.e(TAG, "FD handoff failed; recycling tun2socks without dropping TUN")
                try {
                    process.destroy()
                } catch (e: Exception) {
                    Log.w(TAG, "Failed to recycle tun2socks after FD handoff failure", e)
                }
            }
        }.start()
    }
    fun handleXrayCoreExit(config: XrayConfig) {
        if (!isRunning || currentConfig !== config || recoveringXray) return
        XrayCoreManager.markRuntimeConnecting(this, config)
        recoveringXray = true
        Thread {
            var attempt = 0
            try {
                while (isRunning && currentConfig === config) {
                    attempt++
                    val shift = (attempt - 1).coerceIn(0, 6)
                    val delayMs = (500L * (1L shl shift)).coerceAtMost(30_000L)
                    Log.w(TAG, "Recovering Xray core attempt $attempt in ${delayMs}ms")
                    Thread.sleep(delayMs)
                    if (!isRunning || currentConfig !== config) break
                    if (XrayCoreManager.startCore(this, config)) {
                        Log.w(TAG, "Xray core recovered without dropping TUN")
                        if (currentProxyOnly || (mInterface != null && tun2socksProcess?.isAlive == true)) {
                            XrayCoreManager.markRuntimeReady(this, config)
                        }
                        return@Thread
                    }
                }
            } catch (_: InterruptedException) {
                // Expected when stopping
            } finally {
                recoveringXray = false
            }
        }.start()
    }
    private fun cleanup(clearDeadline: Boolean = true) {
        isRunning = false
        if (clearDeadline) {
            clearSessionDeadline()
        } else {
            deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
            sessionDeadlineElapsed = null
            sessionDeadlineToken = null
        }
        recoveringXray = false
        recoveringTun2socks = false
        tun2socksRecoveryAttempt = 0
        currentProxyOnly = false
        AppConfigs.RUNTIME_READY = false
        tun2socksProcess?.destroy()
        tun2socksProcess = null
        try {
            mInterface?.close()
            mInterface = null
        } catch (e: Exception) {
            Log.w(TAG, "Failed to close VPN interface during cleanup", e)
        }
    }
    // Anything that stops a live tunnel unasked must say so. isRunning is read
    // before cleanup() clears it, which keeps a failed connect silent.
    private fun stopAll(
        confirmationToken: String = currentConfig?.RUNTIME_TOKEN.orEmpty(),
        userRequested: Boolean = false,
    ) {
        if (shuttingDownIntentionally) return
        val alertUser = isRunning && !userRequested
        shuttingDownIntentionally = true
        cleanup(clearDeadline = true)
        currentConfig = null
        XrayCoreManager.stopCore(this, confirmationToken)
        stopForeground(true)
        stopSelf()
        if (alertUser) RevoltAlerts.postDisconnected(this)
    }
    private fun armSessionDeadline(config: XrayConfig, remainingSeconds: Long) {
        val boundedSeconds = remainingSeconds
            .coerceAtLeast(0L)
            .coerceAtMost(Long.MAX_VALUE / 1000L)
        val delayMs = boundedSeconds * 1000L
        val nowEpochMs = System.currentTimeMillis()
        val epochDeadline = if (Long.MAX_VALUE - nowEpochMs < delayMs) {
            Long.MAX_VALUE
        } else {
            nowEpochMs + delayMs
        }
        sessionDeadlineToken = config.RUNTIME_TOKEN
        sessionDeadlineElapsed = SystemClock.elapsedRealtime() + delayMs
        if (!persistDeadline(config.RUNTIME_TOKEN, epochDeadline) ||
            !scheduleSessionExpiryAlarm(config.RUNTIME_TOKEN, epochDeadline)
        ) {
            Log.e(TAG, "Could not arm OS-level session expiry; stopping fail-closed")
            stopAll(config.RUNTIME_TOKEN)
            return
        }
        armExpiryWarning(config.RUNTIME_TOKEN, epochDeadline)
        deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
        if (delayMs == 0L) deadlineHandler.post(sessionDeadlineRunnable)
        else deadlineHandler.postDelayed(sessionDeadlineRunnable, delayMs)
    }
    // Advisory, unlike the deadline itself: nothing here fails closed. Dart
    // re-pushes the deadline every sync, so this runs about once a minute.
    private fun armExpiryWarning(runtimeToken: String, expiresAtEpochMs: Long) {
        if (runtimeToken.isEmpty()) return
        val warnAt = expiresAtEpochMs - RevoltAlerts.WARNING_LEAD_MS
        // Inside the window already (or the short bootstrap deadline). Cancel
        // nothing here: with no dedupe on the re-push, cancelling on this
        // branch deletes the armed warning and never re-arms it.
        if (warnAt <= System.currentTimeMillis() + WARNING_REARM_GRACE_MS) return
        cancelSessionWarningAlarm()
        // A warning on screen now belongs to an older deadline (top-up).
        RevoltAlerts.cancelExpiryWarning(this)
        try {
            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
            val pendingIntent = sessionWarningPendingIntent(runtimeToken)
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
                // Inexact on purpose - keeps this off SCHEDULE_EXACT_ALARM.
                alarmManager.setAndAllowWhileIdle(
                    AlarmManager.RTC_WAKEUP,
                    warnAt,
                    pendingIntent,
                )
            } else {
                alarmManager.set(AlarmManager.RTC_WAKEUP, warnAt, pendingIntent)
            }
        } catch (e: Exception) {
            Log.w(TAG, "Failed to schedule session-expiry warning", e)
        }
        // postDelayed runs on uptimeMillis, so a truly suspended device still
        // fires this late - handleSessionWarningAlarm then rejects it on the
        // window check rather than claiming "5 minutes" with seconds left.
        // Whenever the process is merely backgrounded, which is the common
        // case, this is what actually delivers the warning.
        val warnDelay = warnAt - System.currentTimeMillis()
        deadlineHandler.removeCallbacks(sessionWarningRunnable)
        if (warnDelay > 0L) {
            deadlineHandler.postDelayed(sessionWarningRunnable, warnDelay)
        }
    }
    private fun handleSessionWarningAlarm(alarmToken: String) {
        val config = currentConfig
        if (config == null) {
            // Woke a process with no live runtime; nothing to warn about.
            stopSelf()
            return
        }
        if (alarmToken.isEmpty() || alarmToken != config.RUNTIME_TOKEN) {
            Log.w(TAG, "Ignoring session warning for stale runtime generation")
            return
        }
        val deadline = sessionDeadlineElapsed ?: return
        val remaining = deadline - SystemClock.elapsedRealtime()
        if (remaining < WARNING_FLOOR_MS ||
            remaining > RevoltAlerts.WARNING_LEAD_MS + WARNING_SLACK_MS
        ) {
            // Too late, or the deadline moved. Saying "5 minutes" with
            // seconds left is worse than silence.
            Log.w(TAG, "Ignoring session warning outside the warning window")
            return
        }
        RevoltAlerts.postExpiryWarning(this)
    }
    private fun clearSessionDeadline() {
        deadlineHandler.removeCallbacks(sessionDeadlineRunnable)
        sessionDeadlineElapsed = null
        sessionDeadlineToken = null
        clearPersistedDeadline()
        cancelSessionExpiryAlarm()
        cancelSessionWarningAlarm()
        RevoltAlerts.cancelExpiryWarning(this)
    }
    private fun enforceSessionDeadline() {
        val token = sessionDeadlineToken ?: return
        val deadline = sessionDeadlineElapsed ?: return
        val config = currentConfig ?: return
        if (config.RUNTIME_TOKEN != token) return
        val remaining = deadline - SystemClock.elapsedRealtime()
        if (remaining > 0L) {
            deadlineHandler.postDelayed(sessionDeadlineRunnable, remaining)
            return
        }
        Log.w(TAG, "Native session deadline expired; stopping runtime fail-closed")
        stopAll(token)
    }
    private fun updateSessionDeadline(intent: Intent) {
        val config = currentConfig ?: return
        val token = intent.getStringExtra("RUNTIME_TOKEN").orEmpty()
        if (token.isEmpty() || token != config.RUNTIME_TOKEN) {
            Log.w(TAG, "Ignoring session deadline update for stale runtime generation")
            return
        }
        val remainingSeconds = intent.getLongExtra("REMAINING_SECONDS", -1L)
        if (remainingSeconds < 0L) {
            Log.w(TAG, "Ignoring invalid negative session deadline")
            return
        }
        armSessionDeadline(config, remainingSeconds)
    }
    private fun persistDeadline(runtimeToken: String, expiresAtEpochMs: Long): Boolean {
        return try {
            getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
                .edit()
                .putString(PREF_RUNTIME_TOKEN, runtimeToken)
                .putLong(PREF_EXPIRES_AT_MS, expiresAtEpochMs)
                .commit()
        } catch (e: Exception) {
            Log.e(TAG, "Failed to persist non-secret session deadline", e)
            false
        }
    }
    private fun clearPersistedDeadline() {
        try {
            getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
                .edit()
                .remove(PREF_RUNTIME_TOKEN)
                .remove(PREF_EXPIRES_AT_MS)
                .apply()
        } catch (e: Exception) {
            Log.w(TAG, "Failed to clear persisted session deadline", e)
        }
    }
    private fun enforcePersistedDeadline(alarmToken: String) {
        val stored = try {
            val prefs = getSharedPreferences(DEADLINE_PREFS, Context.MODE_PRIVATE)
            prefs.getString(PREF_RUNTIME_TOKEN, null).orEmpty() to
                prefs.getLong(PREF_EXPIRES_AT_MS, 0L)
        } catch (e: Exception) {
            Log.e(TAG, "Failed to read persisted session deadline", e)
            clearPersistedDeadline()
            cancelSessionExpiryAlarm()
            stopSelf()
            return
        }
        val storedToken = stored.first
        val storedDeadline = stored.second
        if (alarmToken.isEmpty() || storedToken.isEmpty() || alarmToken != storedToken) {
            Log.w(TAG, "Ignoring stale session-expiry alarm")
            if (currentConfig == null) stopSelf()
            return
        }
        val remaining = storedDeadline - System.currentTimeMillis()
        if (storedDeadline > 0L && remaining > 0L) {
            if (!scheduleSessionExpiryAlarm(storedToken, storedDeadline)) {
                Log.e(TAG, "Failed to re-arm early session-expiry alarm")
                val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
                if (activeToken == storedToken) stopAll(storedToken) else stopSelf()
                return
            }
            // An alarm can wake a fresh service process after clock changes.
            // If there is no live runtime in this process, do not leave a
            // background service instance hanging around just to hold a timer.
            if (currentConfig == null) stopSelf()
            return
        }
        Log.w(TAG, "OS session-expiry alarm fired; stopping runtime fail-closed")
        val activeToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
        if (activeToken.isNotEmpty() && activeToken == storedToken) {
            stopAll(storedToken)
        } else {
            clearPersistedDeadline()
            cancelSessionExpiryAlarm()
            cancelSessionWarningAlarm()
            RevoltAlerts.cancelExpiryWarning(this)
            stopForeground(true)
            stopSelf()
            // This arm does not go through stopAll, so it posts for itself.
            RevoltAlerts.postDisconnected(this)
        }
    }
    private fun scheduleSessionExpiryAlarm(runtimeToken: String, expiresAtEpochMs: Long): Boolean {
        cancelSessionExpiryAlarm()
        if (runtimeToken.isEmpty() || expiresAtEpochMs <= 0L) return false
        return try {
            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
            val pendingIntent = sessionExpiryPendingIntent(runtimeToken)
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
                try {
                    alarmManager.setExactAndAllowWhileIdle(
                        AlarmManager.RTC_WAKEUP,
                        expiresAtEpochMs,
                        pendingIntent,
                    )
                } catch (_: SecurityException) {
                    Log.w(TAG, "Exact alarm unavailable; using inexact idle-capable expiry alarm")
                    alarmManager.setAndAllowWhileIdle(
                        AlarmManager.RTC_WAKEUP,
                        expiresAtEpochMs,
                        pendingIntent,
                    )
                }
            } else {
                alarmManager.setExact(AlarmManager.RTC_WAKEUP, expiresAtEpochMs, pendingIntent)
            }
            true
        } catch (e: Exception) {
            Log.e(TAG, "Failed to schedule OS session-expiry alarm", e)
            false
        }
    }
    private fun cancelSessionExpiryAlarm() {
        try {
            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
            alarmManager.cancel(sessionExpiryPendingIntent(""))
        } catch (e: Exception) {
            Log.w(TAG, "Failed to cancel session-expiry alarm", e)
        }
    }
    private fun cancelSessionWarningAlarm() {
        deadlineHandler.removeCallbacks(sessionWarningRunnable)
        try {
            val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
            // Look it up rather than build it: FLAG_UPDATE_CURRENT would
            // rewrite the live alarm's RUNTIME_TOKEN to "" before cancelling.
            existingSessionWarningPendingIntent()?.let { alarmManager.cancel(it) }
        } catch (e: Exception) {
            Log.w(TAG, "Failed to cancel session-warning alarm", e)
        }
    }
    private fun existingSessionWarningPendingIntent(): PendingIntent? {
        val intent = Intent(this, XrayVPNService::class.java)
            .putExtra(EXTRA_SESSION_WARNING, true)
        val flags = PendingIntent.FLAG_NO_CREATE or
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
        return PendingIntent.getService(this, SESSION_WARNING_REQUEST_CODE, intent, flags)
    }
    // Identity is component + request code, not extras, so the warning needs
    // its own code or it clobbers the expiry alarm.
    private fun sessionWarningPendingIntent(runtimeToken: String): PendingIntent {
        val intent = Intent(this, XrayVPNService::class.java)
            .putExtra(EXTRA_SESSION_WARNING, true)
            .putExtra("RUNTIME_TOKEN", runtimeToken)
        val flags = PendingIntent.FLAG_UPDATE_CURRENT or
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
        return PendingIntent.getService(this, SESSION_WARNING_REQUEST_CODE, intent, flags)
    }
    private fun sessionExpiryPendingIntent(runtimeToken: String): PendingIntent {
        val intent = Intent(this, XrayVPNService::class.java)
            .putExtra(EXTRA_SESSION_EXPIRED, true)
            .putExtra("RUNTIME_TOKEN", runtimeToken)
        val flags = PendingIntent.FLAG_UPDATE_CURRENT or
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
        return PendingIntent.getService(this, SESSION_EXPIRY_REQUEST_CODE, intent, flags)
    }
    override fun onDestroy() {
        if (!shuttingDownIntentionally) {
            val confirmationToken = currentConfig?.RUNTIME_TOKEN.orEmpty()
            cleanup(clearDeadline = false)
            currentConfig = null
            XrayCoreManager.stopCore(this, confirmationToken)
            stopForeground(true)
        }
        super.onDestroy()
    }
    override fun onRevoke() {
        stopAll(userRequested = true)
        super.onRevoke()
    }
    private fun createNotificationChannel() {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
            val channelId = "REVOLT_VPN_SERVICE"
            val channelName = "VPN Service"
            val channel = android.app.NotificationChannel(
                channelId,
                channelName,
                android.app.NotificationManager.IMPORTANCE_LOW
            )
            val manager = getSystemService(android.app.NotificationManager::class.java)
            manager?.createNotificationChannel(channel)
        }
    }
    private fun createNotification(content: String): android.app.Notification {
        val channelId = "REVOLT_VPN_SERVICE"
        val builder = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
            android.app.Notification.Builder(this, channelId)
        } else {
            @Suppress("DEPRECATION")
            android.app.Notification.Builder(this)
        }
        val icon = resources.getIdentifier("notification_icon", "drawable", packageName)
            .takeIf { it != 0 } ?: android.R.drawable.ic_dialog_info
        val notification = builder
            .setContentTitle("VPN Service")
            .setContentText(content)
            .setSmallIcon(icon)
            .setOngoing(true)
            .setAutoCancel(false)
            .setOnlyAlertOnce(true)
            .build()
        notification.flags = notification.flags or
            android.app.Notification.FLAG_ONGOING_EVENT or
            android.app.Notification.FLAG_NO_CLEAR
        return notification
    }
    companion object {
        private const val TAG = "XrayVPNService"
        private const val FOREGROUND_SERVICE_TYPE_SPECIAL_USE = 0x40000000
        private const val BOOTSTRAP_SESSION_SECONDS = 120L
        private const val DEADLINE_PREFS = "revolt_session_deadline"
        private const val PREF_RUNTIME_TOKEN = "runtime_token"
        private const val PREF_EXPIRES_AT_MS = "expires_at_ms"
        private const val EXTRA_SESSION_EXPIRED = "SESSION_EXPIRED"
        private const val EXTRA_SESSION_WARNING = "SESSION_WARNING"
        private const val SESSION_EXPIRY_REQUEST_CODE = 1001
        private const val SESSION_WARNING_REQUEST_CODE = 1002
        // Drift allowed before a warning is treated as belonging elsewhere.
        private const val WARNING_SLACK_MS = 60_000L
        // Don't re-arm for a deadline that moved by round-trip jitter alone.
        private const val WARNING_REARM_GRACE_MS = 15_000L
        // Below this the warning has lost its point.
        private const val WARNING_FLOOR_MS = 60_000L
    }
 }
@@ -0,0 +1,49 @@
 package com.github.tfox.flutter_vless.xray.utils
 import com.github.tfox.flutter_vless.xray.dto.XrayConfig
 import java.io.Serializable
 /**
 * Global application configuration and state.
 *
 * This object holds:
 * 1. Constants for Intent actions and Service commands.
 * 2. Enums for connection states and modes.
 * 3. Global state variables (current connection state, active config).
 * 4. Static storage for notification icon resources (passed from Flutter).
 */
 object AppConfigs {
    const val V2RAY_CONNECTION_INFO = "com.github.tfox.flutter_vless.xray.V2RAY_CONNECTION_INFO"
    /**
     * Commands sent to the XrayVPNService via Intent.
     */
    enum class V2RAY_SERVICE_COMMANDS : Serializable {
        START_SERVICE, STOP_SERVICE, RESTART_SERVICE, UPDATE_SESSION_DEADLINE
    }
    /**
     * Connection states for the Xray Core.
     */
    enum class V2RAY_STATES : Serializable {
        V2RAY_CONNECTED, V2RAY_DISCONNECTED, V2RAY_CONNECTING
    }
    /**
     * Connection modes:
     * - VPN_TUN: Standard VPN mode using Android VpnService (TUN device).
     * - PROXY_ONLY: Runs Xray as a local SOCKS/HTTP proxy without establishing a VPN tunnel.
     */
    enum class V2RAY_CONNECTION_MODES : Serializable {
        VPN_TUN, PROXY_ONLY
    }
    var V2RAY_STATE: V2RAY_STATES = V2RAY_STATES.V2RAY_DISCONNECTED
    @Volatile var RUNTIME_READY: Boolean = false
    var V2RAY_CONFIG: XrayConfig? = null
    var V2RAY_CONNECTION_MODE: V2RAY_CONNECTION_MODES = V2RAY_CONNECTION_MODES.VPN_TUN
    // Stores the resource name and type for the custom notification icon
    var NOTIFICATION_ICON_RESOURCE_NAME: String = ""
    var NOTIFICATION_ICON_RESOURCE_TYPE: String = ""
 }
@@ -0,0 +1,143 @@
 package com.github.tfox.flutter_vless.xray.utils
 import android.app.Notification
 import android.app.NotificationChannel
 import android.app.NotificationManager
 import android.app.PendingIntent
 import android.content.Context
 import android.content.Intent
 import android.content.pm.PackageManager
 import android.os.Build
 import android.util.Log
 // local_packages/.../xray/utils/RevoltAlerts.kt
 //
 // The two session alerts. Both XrayVPNService (:RunSoLibXrayDaemon) and
 // MainActivity post them, sharing ids so a second post replaces. Separate from
 // the foreground-service notification (id 1, IMPORTANCE_LOW): these must be
 // noticed, and must be dismissible.
 object RevoltAlerts {
    const val CHANNEL_ID = "REVOLT_VPN_ALERTS"
    const val WARNING_NOTIFICATION_ID = 2
    const val DISCONNECTED_NOTIFICATION_ID = 3
    const val WARNING_LEAD_MS = 5 * 60 * 1000L
    private const val TAG = "RevoltAlerts"
    private const val LAUNCH_REQUEST_CODE = 2001
    // Neither line names a number or a mechanism, because this notification
    // cannot honour either. The caller accepts it anywhere from WARNING_FLOOR_MS
    // to WARNING_LEAD_MS + WARNING_SLACK_MS remaining, so "5 minutes" can be
    // off by four of them; and "watch an ad" is a dead end in a release build,
    // where the support bypass is still kDebugMode-gated (rule 87). Put the
    // number back once the warning is punctual, and the ad back once the
    // support button works without a debug build.
    fun postExpiryWarning(context: Context) {
        post(
            context,
            WARNING_NOTIFICATION_ID,
            "Revolt VPN disconnects soon",
            "Open the app to extend your session.",
        )
    }
    fun postDisconnected(context: Context) {
        post(
            context,
            DISCONNECTED_NOTIFICATION_ID,
            "Revolt VPN disconnected",
            "Your traffic is no longer protected. Tap to reconnect.",
        )
    }
    fun cancelExpiryWarning(context: Context) = cancel(context, WARNING_NOTIFICATION_ID)
    fun cancelDisconnected(context: Context) = cancel(context, DISCONNECTED_NOTIFICATION_ID)
    fun cancelAll(context: Context) {
        cancelExpiryWarning(context)
        cancelDisconnected(context)
    }
    private fun cancel(context: Context, id: Int) {
        try {
            manager(context)?.cancel(id)
        } catch (e: Exception) {
            Log.w(TAG, "Failed to cancel alert $id", e)
        }
    }
    private fun post(context: Context, id: Int, title: String, text: String) {
        if (!canPost(context)) {
            Log.w(TAG, "POST_NOTIFICATIONS not granted; dropping alert $id")
            return
        }
        try {
            val manager = manager(context) ?: return
            ensureChannel(manager)
            val builder = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
                Notification.Builder(context, CHANNEL_ID)
            } else {
                @Suppress("DEPRECATION")
                Notification.Builder(context).setPriority(Notification.PRIORITY_HIGH)
            }
            val icon = context.resources
                .getIdentifier("notification_icon", "drawable", context.packageName)
                .takeIf { it != 0 } ?: android.R.drawable.ic_dialog_info
            builder
                .setContentTitle(title)
                .setContentText(text)
                .setStyle(Notification.BigTextStyle().bigText(text))
                .setSmallIcon(icon)
                .setAutoCancel(true)
                .setOngoing(false)
                // A replacing post must not sound again.
                .setOnlyAlertOnce(true)
            launchIntent(context)?.let { builder.setContentIntent(it) }
            manager.notify(id, builder.build())
        } catch (e: Exception) {
            Log.w(TAG, "Failed to post alert $id", e)
        }
    }
    private fun canPost(context: Context): Boolean {
        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU) return true
        return context.checkSelfPermission(android.Manifest.permission.POST_NOTIFICATIONS) ==
            PackageManager.PERMISSION_GRANTED
    }
    private fun manager(context: Context): NotificationManager? =
        context.getSystemService(Context.NOTIFICATION_SERVICE) as? NotificationManager
    // Importance is fixed at creation, so ask for HIGH up front.
    private fun ensureChannel(manager: NotificationManager) {
        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
        if (manager.getNotificationChannel(CHANNEL_ID) != null) return
        val channel = NotificationChannel(
            CHANNEL_ID,
            "Session alerts",
            NotificationManager.IMPORTANCE_HIGH,
        )
        channel.description = "Warns before a session ends and when protection stops."
        manager.createNotificationChannel(channel)
    }
    private fun launchIntent(context: Context): PendingIntent? {
        val intent = context.packageManager.getLaunchIntentForPackage(context.packageName)
            ?: return null
        intent.flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or
            Intent.FLAG_ACTIVITY_CLEAR_TOP or
            Intent.FLAG_ACTIVITY_NEW_TASK
        val flags = PendingIntent.FLAG_UPDATE_CURRENT or
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) PendingIntent.FLAG_IMMUTABLE else 0
        return PendingIntent.getActivity(context, LAUNCH_REQUEST_CODE, intent, flags)
    }
 }
@@ -0,0 +1,62 @@
 package com.github.tfox.flutter_vless.xray.utils
 import android.content.Context
 import java.io.File
 import java.io.FileOutputStream
 import java.io.IOException
 import java.io.InputStream
 import java.io.OutputStream
 object Utilities {
    fun getUserAssetsPath(context: Context): String {
        val dir = context.filesDir
        if (!dir.exists()) {
            dir.mkdirs()
        }
        return dir.absolutePath
    }
    fun copyAssets(context: Context) {
        val assets = context.assets
        val files = assets.list("") ?: return
        for (filename in files) {
            if (filename == "geoip.dat" || filename == "geosite.dat") {
                var `in`: InputStream? = null
                var out: OutputStream? = null
                try {
                    `in` = assets.open(filename)
                    val outFile = File(getUserAssetsPath(context), filename)
                    out = FileOutputStream(outFile)
                    copyFile(`in`, out)
                } catch (e: IOException) {
                    e.printStackTrace()
                } finally {
                    if (`in` != null) {
                        try {
                            `in`.close()
                        } catch (e: IOException) {
                            e.printStackTrace()
                        }
                    }
                    if (out != null) {
                        try {
                            out.close()
                        } catch (e: IOException) {
                            e.printStackTrace()
                        }
                    }
                }
            }
        }
    }
    @Throws(IOException::class)
    private fun copyFile(`in`: InputStream, out: OutputStream) {
        val buffer = ByteArray(1024)
        var read: Int
        while (`in`.read(buffer).also { read = it } != -1) {
            out.write(buffer, 0, read)
        }
    }
 }
@@ -0,0 +1,178 @@
 package com.github.tfox.flutter_vless.xray.core
 import com.github.tfox.flutter_vless.xray.dto.XrayConfig
 import java.io.File
 import org.json.JSONObject
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Assert.fail
 import org.junit.Test
 class XrayCoreManagerTest {
    @Test
    fun buildRuntimeConfigJson_keepsSecureSocksAndSanitizesLogs() {
        val filesDir = File("build/test-files/runtime-secure")
        val config = XrayConfig(
            V2RAY_FULL_JSON_CONFIG = runtimeConfig(
                extraLog = """
                    "log": {
                      "access": "/tmp/access.log",
                      "error": "/tmp/error.log"
                    },
                """.trimIndent(),
            )
        )
        val output = XrayCoreManager.buildRuntimeConfigJson(config, filesDir)
        val log = output.getJSONObject("log")
        val inbound = output.getJSONArray("inbounds").getJSONObject(0)
        val user = output
            .getJSONArray("outbounds")
            .getJSONObject(0)
            .getJSONObject("settings")
            .getJSONArray("vnext")
            .getJSONObject(0)
            .getJSONArray("users")
            .getJSONObject(0)
        assertFalse(log.has("access"))
        assertEquals(File(filesDir, "error.log").absolutePath, log.getString("error"))
        assertEquals("revolt-secure-socks", inbound.getString("tag"))
        assertEquals("password", inbound.getJSONObject("settings").getString("auth"))
        assertEquals(19080, config.LOCAL_SOCKS5_PORT)
        assertEquals(0, config.LOCAL_HTTP_PORT)
        assertEquals(vlessEncryption, user.getString("encryption"))
        assertEquals("xtls-rprx-vision", user.getString("flow"))
    }
    @Test
    fun buildRuntimeConfigJson_rejectsInvalidSecureSocks() {
        val config = XrayConfig(
            V2RAY_FULL_JSON_CONFIG = """
                {
                  "inbounds": [
                    {
                      "tag": "revolt-secure-socks",
                      "listen": "127.0.0.1",
                      "port": 19080,
                      "protocol": "socks",
                      "settings": { "auth": "noauth", "users": [] }
                    }
                  ],
                  "outbounds": []
                }
            """.trimIndent()
        )
        try {
            XrayCoreManager.buildRuntimeConfigJson(
                config,
                File("build/test-files/runtime-invalid-socks"),
            )
            fail("Invalid secure SOCKS5 configuration must fail closed")
        } catch (expected: IllegalStateException) {
            assertTrue(expected.message.orEmpty().contains("Secure SOCKS5"))
        }
    }
    @Test
    fun buildRuntimeConfigJson_normalizesXrayRuntimeAliases() {
        val config = XrayConfig(
            V2RAY_FULL_JSON_CONFIG = """
                {
                  "inbounds": [
                    {
                      "tag": "revolt-secure-socks",
                      "listen": "127.0.0.1",
                      "port": 19080,
                      "protocol": "socks",
                      "settings": {
                        "auth": "password",
                        "users": [{"user": "runtime-user", "pass": "runtime-pass"}]
                      }
                    }
                  ],
                  "outbounds": [
                    {
                      "protocol": "vless",
                      "settings": {
                        "vnext": [
                          {
                            "address": "example.com",
                            "port": 443,
                            "users": [{"id": "11111111-1111-4111-8111-111111111111", "encryption": "none"}]
                          }
                        ]
                      },
                      "streamSettings": {
                        "network": "XHTTP",
                        "security": "tls",
                        "tlsSettings": {"allowInsecure": false, "serverName": "example.com"},
                        "xHTTPSettings": {"path": "/", "mode": "auto"},
                        "httpUpgradeSettings": {"path": "/upgrade"},
                        "splitHTTPSettings": {"path": "/split"}
                      }
                    }
                  ]
                }
            """.trimIndent()
        )
        val output = XrayCoreManager.buildRuntimeConfigJson(
            config,
            File("build/test-files/runtime-aliases"),
        )
        val stream = output
            .getJSONArray("outbounds")
            .getJSONObject(0)
            .getJSONObject("streamSettings")
        assertEquals("xhttp", stream.getString("network"))
        assertTrue(stream.has("xhttpSettings"))
        assertTrue(stream.has("httpupgradeSettings"))
        assertTrue(stream.has("splithttpSettings"))
        assertFalse(stream.has("xHTTPSettings"))
        assertFalse(stream.has("httpUpgradeSettings"))
        assertFalse(stream.has("splitHTTPSettings"))
        assertFalse(stream.getJSONObject("tlsSettings").has("allowInsecure"))
    }
    private fun runtimeConfig(extraLog: String = ""): String = """
        {
          $extraLog
          "inbounds": [
            {
              "tag": "revolt-secure-socks",
              "listen": "127.0.0.1",
              "port": 19080,
              "protocol": "socks",
              "settings": {
                "auth": "password",
                "users": [{"user": "runtime-user", "pass": "runtime-pass"}]
              }
            }
          ],
          "outbounds": [
            {
              "tag": "proxy",
              "protocol": "vless",
              "settings": {
                "address": "xhttp.example.com",
                "port": 443,
                "id": "b94da146-a56e-49d7-af4c-a68c9065cbfd",
                "encryption": "$vlessEncryption",
                "flow": "xtls-rprx-vision",
                "level": 8
              },
              "streamSettings": {"network": "xhttp", "security": "none"}
            }
          ]
        }
    """.trimIndent()
    private companion object {
        const val vlessEncryption =
            "mlkem768x25519plus.native.1rtt.100-500-2000.75-0-100.80-0-5000.gtmOXB2AN_r905czmOIr6dKq_YDdEJB8RWGqfsXurns"
    }
 }
@@ -0,0 +1,13 @@
 // Copyright (c) 2024-2026 13FOX Studio / tfox.dev.
 // SPDX-License-Identifier: MIT
 import 'package:flutter_vless_platform_interface/flutter_vless_platform_interface.dart';
 /// Android implementation of [VlessPlatform] using MethodChannel.
 class FlutterVlessAndroid extends VlessMethodChannelAdapter {
  /// Registers this class as the platform implementation.
  /// This is called automatically by Flutter's plugin registry.
  static void registerWith() {
    VlessPlatform.instance = FlutterVlessAndroid();
  }
 }
@@ -0,0 +1,31 @@
 name: flutter_vless_android
 description: Android implementation of the flutter_vless plugin.
 version: 1.1.5
 homepage: https://tfox.dev
 repository: https://github.com/XIIIFOX/flutter_vless
 issue_tracker: https://github.com/XIIIFOX/flutter_vless/issues
 documentation: https://github.com/XIIIFOX/flutter_vless/blob/main/doc/platform/android.md
 funding:
  - https://tfox.dev
 environment:
  sdk: '>=3.4.0 <4.0.0'
  flutter: '>=3.3.0'
 dependencies:
  flutter:
    sdk: flutter
  flutter_vless_platform_interface: ^1.1.0
 dev_dependencies:
  flutter_test:
    sdk: flutter
  flutter_lints: ^6.0.0
 flutter:
  plugin:
    implements: flutter_vless_platform_interface
    platforms:
      android:
        package: com.github.tfox.flutter_vless
        pluginClass: FlutterVlessPlugin
@@ -65,22 +65,6 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "3.0.7"
  cupertino_icons:
    dependency: "direct main"
    description:
      name: cupertino_icons
      sha256: "41e005c33bd814be4d3096aff55b1908d419fde52ca656c8c47719ec745873cd"
      url: "https://pub.dev"
    source: hosted
    version: "1.0.9"
  dbus:
    dependency: transitive
    description:
      name: dbus
      sha256: d0c98dcd4f5169878b6cf8f6e0a52403a9dff371a3e2f019697accbf6f44a270
      url: "https://pub.dev"
    source: hosted
    version: "0.7.12"
  fake_async:
    dependency: transitive
    description:
@@ -126,30 +110,6 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "3.0.2"
  flutter_local_notifications:
    dependency: "direct main"
    description:
      name: flutter_local_notifications
      sha256: "674173fd3c9eda9d4c8528da2ce0ea69f161577495a9cc835a2a4ecd7eadeb35"
      url: "https://pub.dev"
    source: hosted
    version: "17.2.4"
  flutter_local_notifications_linux:
    dependency: transitive
    description:
      name: flutter_local_notifications_linux
      sha256: c49bd06165cad9beeb79090b18cd1eb0296f4bf4b23b84426e37dd7c027fc3af
      url: "https://pub.dev"
    source: hosted
    version: "4.0.1"
  flutter_local_notifications_platform_interface:
    dependency: transitive
    description:
      name: flutter_local_notifications_platform_interface
      sha256: "85f8d07fe708c1bdcf45037f2c0109753b26ae077e9d9e899d55971711a4ea66"
      url: "https://pub.dev"
    source: hosted
    version: "7.2.0"
  flutter_secure_storage:
    dependency: "direct main"
    description:
@@ -212,12 +172,11 @@ packages:
    source: hosted
    version: "1.1.5"
  flutter_vless_android:
-    dependency: transitive
+    dependency: "direct overridden"
    description:
-      name: flutter_vless_android
+      path: "local_packages/flutter_vless_android-1.1.5"
-      sha256: "5e6fe73d3606ed8c73e87fac15efa7631e12ce18d39a4bd4e13b6c097c6d52b9"
+      relative: true
-      url: "https://pub.dev"
+    source: path
    source: hosted
    version: "1.1.5"
  flutter_vless_macos:
    dependency: transitive
@@ -248,14 +207,6 @@ packages:
    description: flutter
    source: sdk
    version: "0.0.0"
  google_fonts:
    dependency: "direct main"
    description:
      name: google_fonts
      sha256: ba03d03bcaa2f6cb7bd920e3b5027181db75ab524f8891c8bc3aa603885b8055
      url: "https://pub.dev"
    source: hosted
    version: "6.3.3"
  google_mobile_ads:
    dependency: "direct main"
    description:
@@ -348,10 +299,10 @@ packages:
    dependency: transitive
    description:
      name: matcher
-      sha256: dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861
+      sha256: "31bd099b47c10cd1aeb55146a2d46ce0277630ecef3f7dae54ad7873f36696cd"
      url: "https://pub.dev"
    source: hosted
-    version: "0.12.19"
+    version: "0.12.20"
  material_color_utilities:
    dependency: transitive
    description:
@@ -364,10 +315,10 @@ packages:
    dependency: transitive
    description:
      name: meta
-      sha256: "1741988757a65eb6b36abe716829688cf01910bbf91c34354ff7ec1c3de2b349"
+      sha256: "307249ce4ff29d58a18e97f6345f539382eb9c9c29ecda628900f31de0443dd9"
      url: "https://pub.dev"
    source: hosted
-    version: "1.18.0"
+    version: "1.19.0"
  nested:
    dependency: transitive
    description:
@@ -417,7 +368,7 @@ packages:
    source: hosted
    version: "1.9.1"
  path_provider:
-    dependency: "direct main"
+    dependency: transitive
    description:
      name: path_provider
      sha256: "50c5dd5b6e1aaf6fb3a78b33f6aa3afca52bf903a8a5298f53101fdaee55bbcd"
@@ -464,14 +415,6 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "2.3.0"
  petitparser:
    dependency: transitive
    description:
      name: petitparser
      sha256: "91bd59303e9f769f108f8df05e371341b15d59e995e6806aefab827b58336675"
      url: "https://pub.dev"
    source: hosted
    version: "7.0.2"
  platform:
    dependency: transitive
    description:
@@ -617,18 +560,10 @@ packages:
    dependency: transitive
    description:
      name: test_api
-      sha256: "949a932224383300f01be9221c39180316445ecb8e7547f70a41a35bf421fb9e"
+      sha256: "2a122cbe059f8b610d3a5415f42e255b6c17b1f21eee1d960f31080237fb4f11"
      url: "https://pub.dev"
    source: hosted
-    version: "0.7.11"
+    version: "0.7.12"
  timezone:
    dependency: transitive
    description:
      name: timezone
      sha256: "2236ec079a174ce07434e89fcd3fcda430025eb7692244139a9cf54fdcf1fc7d"
      url: "https://pub.dev"
    source: hosted
    version: "0.9.4"
  typed_data:
    dependency: transitive
    description:
@@ -713,10 +648,10 @@ packages:
    dependency: transitive
    description:
      name: vector_math
-      sha256: d530bd74fea330e6e364cda7a85019c434070188383e1cd8d9777ee586914c5b
+      sha256: f36f9f3be64c6198714492bb455c11056e33e2f85d9a0b676a48301e44fdcf47
      url: "https://pub.dev"
    source: hosted
-    version: "2.2.0"
+    version: "2.4.2"
  vm_service:
    dependency: transitive
    description:
@@ -781,14 +716,6 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "1.1.0"
  xml:
    dependency: transitive
    description:
      name: xml
      sha256: "971043b3a0d3da28727e40ed3e0b5d18b742fa5a68665cca88e74b7876d5e025"
      url: "https://pub.dev"
    source: hosted
    version: "6.6.1"
  yaml:
    dependency: transitive
    description:
@@ -798,5 +725,5 @@ packages:
    source: hosted
    version: "3.1.3"
 sdks:
-  dart: ">=3.10.3 <4.0.0"
+  dart: ">=3.11.0-0 <4.0.0"
  flutter: ">=3.38.4"
@@ -15,7 +15,7 @@ publish_to: "none" # Remove this line if you wish to publish to pub.dev
 # In iOS, build-name is used as CFBundleShortVersionString while build-number used as CFBundleVersion.
 # Read more about iOS versioning at
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
-version: 3.2.1+24
+version: 3.3.8+34
 environment:
  sdk: ">=3.0.0 <4.0.0"
@@ -24,10 +24,6 @@ dependencies:
  flutter:
    sdk: flutter
  # The following adds the Cupertino Icons font to your application.
  # Use with the CupertinoIcons class for iOS style icons.
  cupertino_icons: ^1.0.5
  google_fonts: ^6.1.0
  provider: ^6.1.1
  google_mobile_ads: ^4.0.0
  flutter_vless: 1.1.5
@@ -36,8 +32,6 @@ dependencies:
  url_launcher: ^6.3.2
  flutter_secure_storage: ^10.3.1
  uuid: ^4.5.3
  flutter_local_notifications: ^17.0.0
  path_provider: ^2.1.5
  package_info_plus: ^6.0.0
 dev_dependencies:
@@ -84,3 +78,7 @@ flutter:
  #
  # For details regarding fonts from package dependencies,
  # see https://flutter.dev/custom-fonts/#from-packages
 dependency_overrides:
  flutter_vless_android:
    path: local_packages/flutter_vless_android-1.1.5
@@ -0,0 +1,87 @@
 import 'dart:convert';
 import 'dart:io';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:revoltvpn/logic/secure_socks_session.dart';
 void main() {
  test('release verification stays fail-closed and reproducible', () {
    final gradle = File('android/app/build.gradle.kts').readAsStringSync();
    final workflow = File('.github/workflows/android-ci.yml').readAsStringSync();
    final lockfile = File('pubspec.lock').readAsStringSync();
    final wrapper =
        File('android/gradle/wrapper/gradle-wrapper.properties').readAsStringSync();
    final verification =
        File('android/gradle/verification-metadata.xml').readAsStringSync();
    final proguard = File('android/app/proguard-rules.pro').readAsStringSync();
    expect(
      wrapper,
      contains(
        'distributionSha256Sum='
        'efe9a3d147d948d7528a9887fa35abcf24ca1a43ad06439996490f77569b02d1',
      ),
    );
    expect(wrapper, contains('validateDistributionUrl=true'));
    expect(verification, contains('<verify-metadata>true</verify-metadata>'));
    expect(verification, contains('<verify-signatures>false</verify-signatures>'));
    expect(verification, contains('<sha256 value='));
    expect(
      verification,
      contains('a804b261645ef8c13eb3d5c44a5c2fb0340c5539'),
    );
    expect(gradle, contains('REVOLT_APP_CONFIG_SHA256'));
    expect(gradle, contains('verifyReleaseAppConfig'));
    expect(gradle, contains('preReleaseBuild'));
    expect(gradle, contains('isMinifyEnabled = true'));
    expect(gradle, contains('isShrinkResources = true'));
    expect(gradle, contains('REVOLT_CI_RELEASE_SMOKE'));
    expect(gradle, contains('signingConfigs.getByName("release")'));
    expect(workflow, contains("flutter-version: '3.47.2'"));
    expect(workflow, contains('Verify Gradle supply chain'));
    expect(workflow, contains('Verify dependency lock is committed'));
    expect(workflow, contains('Verify production release config fails closed'));
    expect(workflow, contains('Cold APK build'));
    expect(workflow, contains('Warm APK build'));
    expect(workflow, contains('Release R8 smoke build'));
    expect(workflow, contains('Verify tracked build inputs stayed immutable'));
    expect(workflow, contains('REVOLT_CI_RELEASE_SMOKE'));
    expect(
      workflow,
      contains('actions/checkout@11d5960a326750d5838078e36cf38b85af677262'),
    );
    expect(
      workflow,
      contains('actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961'),
    );
    expect(lockfile, contains('dart: ">=3.11.0-0 <4.0.0"'));
    expect(proguard, contains('-keep class io.flutter.** { *; }'));
    expect(proguard, contains('-keep class xray.** { *; }'));
  });
  test('runtime keeps authenticated SOCKS on the IPv4 loopback', () async {
    final session = await SecureSocksSession.create(jsonEncode({
      'inbounds': <Object?>[],
      'outbounds': <Object?>[],
    }));
    final config = jsonDecode(session.configJson) as Map<String, dynamic>;
    final inbounds = config['inbounds'] as List<dynamic>;
    final inbound = inbounds.single as Map<String, dynamic>;
    final settings = inbound['settings'] as Map<String, dynamic>;
    final users = settings['users'] as List<dynamic>;
    final account = users.single as Map<String, dynamic>;
    expect(inbound['tag'], SecureSocksSession.inboundTag);
    expect(inbound['listen'], '127.0.0.1');
    expect(inbound['port'], session.port);
    expect(settings['auth'], 'password');
    expect(account['user'], session.username);
    expect(account['pass'], session.password);
    expect(session.username, isNotEmpty);
    expect(session.password, isNotEmpty);
  });
 }
@@ -0,0 +1,187 @@
 import 'dart:io';
 import 'package:flutter_test/flutter_test.dart';
 // Source assertions, in the style of release_verification_regression_test.dart.
 // The behaviours below were all found broken on a device and fixed on
 // 2026-10-17 (internal/DEVICE_TEST_2026-10-17.md). None of them can be covered
 // by a Dart unit test - they live in the vendored Android runtime, and the one
 // that does not needs a live tunnel - but every one of them regresses silently
 // and looks like tidying when it does. Pin the shape instead of the behaviour.
 const _runtime = 'local_packages/flutter_vless_android-1.1.5/android/src/main/'
    'kotlin/com/github/tfox/flutter_vless/xray';
 void main() {
  test('Xray core recovery survives running off a bare thread', () {
    final core = File('$_runtime/core/XrayCoreManager.kt').readAsStringSync();
    // startTimer builds a CountDownTimer, which builds a Handler. Recovery runs
    // on a plain Thread, so constructing it inline threw Looper.prepare() and
    // killed every restart attempt.
    expect(core, contains('Handler(Looper.getMainLooper())'));
    expect(core, contains('runOnMain'));
    expect(
      core,
      contains('runOnMain { startTimerOnMain(context, token) }'),
      reason: 'startTimer must not construct the CountDownTimer inline',
    );
    // The post must not outlive the generation that scheduled it.
    expect(core, contains('if (AppConfigs.V2RAY_CONFIG?.RUNTIME_TOKEN != token) return'));
    // pb.start() succeeds before the throw, so the catch has to kill the
    // process or each retry strands another live core.
    expect(core, contains('val orphan = xrayProcess'));
    expect(
      core.indexOf('xrayProcess = null'),
      lessThan(core.indexOf('orphan?.destroy()')),
      reason: 'clear the field before destroying, so the monitor thread\'s '
          'identity guard fails and recovery is not re-entered',
    );
  });
  test('a failed Xray core still reports why, without logging destinations', () {
    final core = File('$_runtime/core/XrayCoreManager.kt').readAsStringSync();
    expect(core, contains('STARTUP_LOG_WINDOW_MS'));
    expect(core, contains('STARTUP_LOG_MAX_LINES'));
    expect(
      core,
      isNot(contains('reader.forEachLine { _ -> }')),
      reason: 'discarding the core output leaves exit 23 undiagnosable',
    );
    // Rule 95: a core that has been up long enough to carry traffic must not
    // have its log retained.
    expect(core, contains('startupLog.clear()'));
  });
  test('the expiry warning has the same backstop as the deadline', () {
    final service = File('$_runtime/service/XrayVPNService.kt').readAsStringSync();
    // The alarm alone is inexact on purpose (no SCHEDULE_EXACT_ALARM) and Doze
    // deferred it past the end of the session it was warning about.
    expect(service, contains('sessionWarningRunnable'));
    expect(
      service,
      contains('deadlineHandler.postDelayed(sessionWarningRunnable, warnDelay)'),
      reason: 'without this the warning never arrives when the app is closed',
    );
    expect(
      service,
      contains('deadlineHandler.removeCallbacks(sessionWarningRunnable)'),
      reason: 'a cancelled warning must drop its Handler callback too',
    );
    expect(service, isNot(contains('SCHEDULE_EXACT_ALARM"')));
  });
  test('the warning promises neither a number of minutes nor an ad', () {
    final alerts = File('$_runtime/utils/RevoltAlerts.kt').readAsStringSync();
    // It is accepted anywhere from WARNING_FLOOR_MS to LEAD + SLACK remaining,
    // so a figure can be off by minutes; and the support bypass is still
    // kDebugMode-gated (rule 87), so an ad is a dead end in release.
    expect(alerts, isNot(contains('disconnects in 5 minutes')));
    expect(alerts, isNot(contains('Watch an ad')));
    expect(alerts, contains('Revolt VPN disconnects soon'));
  });
  test('the countdown notification is taken down when the tunnel stops', () {
    final service = File('lib/logic/notification_service.dart').readAsStringSync();
    final timer = File('lib/logic/session_timer.dart').readAsStringSync();
    final activity =
        File('android/app/src/main/kotlin/com/paladinvpn/app/MainActivity.kt')
            .readAsStringSync();
    // updateTimer re-posts an ongoing, non-dismissible notification every tick,
    // so a tick after the service stops strands a frozen countdown.
    expect(service, contains('cancelTimer'));
    expect(activity, contains('"cancelNotification"'));
    expect(timer, contains('await NotificationService.cancelTimer()'));
    // Must run after the service is down, or the platform swallows the cancel.
    expect(
      timer.indexOf('await vpnConnection.disconnect();'),
      lessThan(timer.indexOf('await NotificationService.cancelTimer()')),
    );
  });
  test('only a user-requested disconnect hands the session back', () {
    final timer = File('lib/logic/session_timer.dart').readAsStringSync();
    final hivemind = File('lib/logic/hivemind_service.dart').readAsStringSync();
    expect(hivemind, contains('releaseSession'));
    expect(hivemind, contains("_publicUrl('/session/stop')"));
    // /session/stop takes a device_id as its only proof of ownership, so it
    // must never be reachable from an error path. disconnect() is called only
    // by the connect button; _doDisconnect is every other ending.
    final disconnectEntry = timer.indexOf('Future<void> disconnect({');
    final doDisconnect = timer.indexOf('Future<void> _doDisconnect(');
    final release = timer.indexOf('HivemindService.releaseSession()');
    expect(release, greaterThan(disconnectEntry));
    expect(
      release,
      lessThan(doDisconnect),
      reason: 'releaseSession belongs in disconnect(), not _doDisconnect',
    );
    expect(
      'HivemindService.releaseSession()'.allMatches(timer).length,
      1,
      reason: 'exactly one call site',
    );
  });
  test('every session starts the same way - no re-attach path', () {
    final mode =
        File('lib/screens/settings/in_settings/connection_mode.dart')
            .readAsStringSync();
    final hivemind = File('lib/logic/hivemind_service.dart').readAsStringSync();
    final vpn = File('lib/logic/vpn_connection.dart').readAsStringSync();
    final timer = File('lib/logic/session_timer.dart').readAsStringSync();
    // SOCKS5 Reconnect used to re-attach to the session already held. It was
    // the only place a session began without an ad and without a nonce binding
    // it, and it needed three parameters and a carve-out in rule 4 to support.
    // Reconnect now ends the session and starts a fresh one, like the button.
    expect(mode, contains("ad.showAd('main')"));
    expect(mode, contains('vpn.connect(adNonce: adNonce)'));
    expect(mode, isNot(contains('resume: true')));
    expect(mode, isNot(contains('release: false')));
    expect(mode, isNot(contains('resetSupportClaim')));
    // The special cases that only existed for it are gone.
    expect(hivemind, isNot(contains('bool resume')));
    expect(vpn, isNot(contains('bool resume')));
    expect(timer, isNot(contains('bool release')));
    expect(timer, isNot(contains('resetSupportClaim')));
    // So the nonce is now unconditional: no path accepts whatever the server
    // happens to hold.
    expect(
      hivemind,
      contains('if (serverNonce is! String || serverNonce != nonce) return null;'),
      reason: 'the nonce check must not be skippable',
    );
  });
  test('nothing probes the control plane while disconnected - rule 60', () {
    final vpn = File('lib/logic/vpn_connection.dart').readAsStringSync();
    final hivemind = File('lib/logic/hivemind_service.dart').readAsStringSync();
    final bar = File('lib/components/status_bar.dart').readAsStringSync();
    // The runtime excludes the app from its own tunnel
    // (XrayVPNService.kt addDisallowedApplication), so a periodic /health probe
    // was a cleartext-SNI metronome to the API host - which resolves to the
    // tunnel IP. It fed step 1 of the kill chain in KNOWN_SECURITY_ISSUES #3,
    // in exchange for a green dot before the user had connected to anything.
    expect(vpn, isNot(contains('_healthTimer')));
    expect(vpn, isNot(contains('_checkHealth')));
    expect(hivemind, isNot(contains('checkHealth')));
    expect(hivemind, isNot(contains("'/health'")));
    // Reachability is passive now: a session sync that succeeded, nothing else.
    expect(bar, isNot(contains('serverReachable')));
    expect(bar, contains('isConnected && timer.hasSyncedOnce'));
  });
 }